Always check context access if the register we're operating on is
PTR_TO_CTX, rather than relying on ARG_PTR_TO_CTX. This allows
simplifying the arg_type checking section of the function.

Signed-off-by: Lorenz Bauer <l...@cloudflare.com>
Acked-by: Martin KaFai Lau <ka...@fb.com>
---
 kernel/bpf/verifier.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 0f7a9c65db5c..7d0f9ba18916 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3974,9 +3974,6 @@ static int check_func_arg(struct bpf_verifier_env *env, 
u32 arg,
                      arg_type == ARG_PTR_TO_CTX_OR_NULL)) {
                        if (type != expected_type)
                                goto err_type;
-                       err = check_ctx_reg(env, reg, regno);
-                       if (err < 0)
-                               return err;
                }
        } else if (arg_type == ARG_PTR_TO_SOCK_COMMON) {
                expected_type = PTR_TO_SOCK_COMMON;
@@ -4060,6 +4057,10 @@ static int check_func_arg(struct bpf_verifier_env *env, 
u32 arg,
                                regno);
                        return -EACCES;
                }
+       } else if (type == PTR_TO_CTX) {
+               err = check_ctx_reg(env, reg, regno);
+               if (err < 0)
+                       return err;
        }
 
        if (reg->ref_obj_id) {
-- 
2.25.1

Reply via email to