bpf: Check scalar or invalid register in check_helper_mem_access

Move the check for a NULL or zero register to check_helper_mem_access. This
makes check_stack_boundary easier to understand.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20200921121227.255763-3-lmb@cloudflare.com

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 4161b6c406bc90a11af381b137d49a91a780ab9c..06238395f2448d37429ed494c2746eefa37bbbe6 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3641,18 +3641,6 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
        struct bpf_func_state *state = func(env, reg);
        int err, min_off, max_off, i, j, slot, spi;
 
-       if (reg->type != PTR_TO_STACK) {
-               /* Allow zero-byte read from NULL, regardless of pointer type */
-               if (zero_size_allowed && access_size == 0 &&
-                   register_is_null(reg))
-                       return 0;
-
-               verbose(env, "R%d type=%s expected=%s\n", regno,
-                       reg_type_str[reg->type],
-                       reg_type_str[PTR_TO_STACK]);
-               return -EACCES;
-       }
-
        if (tnum_is_const(reg->var_off)) {
                min_off = max_off = reg->var_off.value + reg->off;
                err = __check_stack_boundary(env, regno, min_off, access_size,
@@ -3797,9 +3785,19 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
                                           access_size, zero_size_allowed,
                                           "rdwr",
                                           &env->prog->aux->max_rdwr_access);
-       default: /* scalar_value|ptr_to_stack or invalid ptr */
+       case PTR_TO_STACK:
                return check_stack_boundary(env, regno, access_size,
                                            zero_size_allowed, meta);
+       default: /* scalar_value or invalid ptr */
+               /* Allow zero-byte read from NULL, regardless of pointer type */
+               if (zero_size_allowed && access_size == 0 &&
+                   register_is_null(reg))
+                       return 0;
+
+               verbose(env, "R%d type=%s expected=%s\n", regno,
+                       reg_type_str[reg->type],
+                       reg_type_str[PTR_TO_STACK]);
+               return -EACCES;
        }
 }