bpf/verifier: add ARG_PTR_TO_UNINIT_MAP_VALUE

ARG_PTR_TO_UNINIT_MAP_VALUE argument is a pointer to a memory zone
used to save the value of a map.  Basically the same as
ARG_PTR_TO_UNINIT_MEM, but the size has not be passed as an extra
argument.

This will be used in the following patch that implements some new
helpers that receive a pointer to be filled with a map value.

Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 6 insertions, 3 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 3f93a548a642..d84c91ac3b70 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2117,7 +2117,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
         }
 
         if (arg_type == ARG_PTR_TO_MAP_KEY ||
-            arg_type == ARG_PTR_TO_MAP_VALUE) {
+            arg_type == ARG_PTR_TO_MAP_VALUE ||
+            arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE) {
                 expected_type = PTR_TO_STACK;
                 if (!type_is_pkt_pointer(type) && type != PTR_TO_MAP_VALUE &&
                     type != expected_type)
@@ -2187,7 +2188,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
                 err = check_helper_mem_access(env, regno,
                                               meta->map_ptr->key_size, false,
                                               NULL);
-        } else if (arg_type == ARG_PTR_TO_MAP_VALUE) {
+        } else if (arg_type == ARG_PTR_TO_MAP_VALUE ||
+                   arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE) {
                 /* bpf_map_xxx(..., map_ptr, ..., value) call:
                  * check [value, value + map->value_size) validity
                  */
@@ -2196,9 +2198,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
                         verbose(env, "invalid map_ptr to access map->value\n");
                         return -EACCES;
                 }
+                meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE);
                 err = check_helper_mem_access(env, regno,
                                               meta->map_ptr->value_size, false,
-                                              NULL);
+                                              meta);
         } else if (arg_type_is_mem_size(arg_type)) {
                 bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);