github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Merge branch 'fix-for-untrusted-btf-pointer-writes'

Browse Source 
Kumar Kartikeya Dwivedi says:

====================
Fix for untrusted BTF pointer writes

When using custom btf_struct_access() callbacks, we miss rejecting
unstrusted BTF pointer writes. Fix and add a selftest for coverage.

Changelog:
----------
v1 -> v2
v1: https://lore.kernel.org/bpf/20260707190214.1997705-1-memxor@gmail.com

 * Add missing fixes tag.
 * Add Amery's acks.
====================

Link: https://patch.msgid.link/20260708030752.2503467-1-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
This commit is contained in:
Eduard Zingerman 2026-07-08 00:32:57 -07:00
commit 6953e5fadb
3 changed files with 44 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
kernel/bpf/verifier.c
View File

@ -5790,6 +5790,11 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
return -EACCES;
}
if (atype != BPF_READ && (type_flag(reg->type) & PTR_UNTRUSTED)) {
verbose(env, "only read is supported\n");
return -EACCES;
}
if (env->ops->btf_struct_access && !type_is_alloc(reg->type) && atype == BPF_WRITE) {
if (!btf_is_kernel(reg->btf)) {
verifier_bug(env, "reg->btf must be kernel btf");
@ -5802,8 +5807,7 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
reg_arg_name(env, argno), tname, off, size);
} else {
/* Writes are permitted with default btf_struct_access for
* program allocated objects (which always have id > 0),
* but not for untrusted PTR_TO_BTF_ID | MEM_ALLOC.
* program allocated objects (which always have id > 0).
*/
if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type)) {
verbose(env, "only read is supported\n");

12
tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
View File

@ -14,6 +14,7 @@
#include "tcp_ca_incompl_cong_ops.skel.h"
#include "tcp_ca_unsupp_cong_op.skel.h"
#include "tcp_ca_kfunc.skel.h"
#include "tcp_ca_untrusted_btf_write.skel.h"
#include "bpf_cc_cubic.skel.h"
static const unsigned int total_bytes = 10 * 1024 * 1024;
@ -579,6 +580,15 @@ static void test_tcp_ca_kfunc(void)
tcp_ca_kfunc__destroy(skel);
}
static void test_untrusted_btf_write(void)
{
struct tcp_ca_untrusted_btf_write *skel;
skel = tcp_ca_untrusted_btf_write__open_and_load();
ASSERT_ERR_PTR(skel, "tcp_ca_untrusted_btf_write__open_and_load");
tcp_ca_untrusted_btf_write__destroy(skel);
}
static void test_cc_cubic(void)
{
struct cb_opts cb_opts = {
@ -637,6 +647,8 @@ void test_bpf_tcp_ca(void)
test_link_replace();
if (test__start_subtest("tcp_ca_kfunc"))
test_tcp_ca_kfunc();
if (test__start_subtest("untrusted_btf_write"))
test_untrusted_btf_write();
if (test__start_subtest("cc_cubic"))
test_cc_cubic();
if (test__start_subtest("dctcp_autoattach_map"))

26
tools/testing/selftests/bpf/progs/tcp_ca_untrusted_btf_write.c Normal file
View File

@ -0,0 +1,26 @@
// SPDX-License-Identifier: GPL-2.0
#include "bpf_tracing_net.h"
#include <bpf/bpf_core_read.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
char _license[] SEC("license") = "GPL";
SEC("struct_ops")
void BPF_PROG(untrusted_btf_write_init, struct sock *sk)
{
struct tcp_sock *tp;
int v = 1;
void *p;
p = bpf_rdonly_cast(&v, 0);
tp = bpf_rdonly_cast(p, bpf_core_type_id_kernel(struct tcp_sock));
tp->snd_cwnd = 1;
}
SEC(".struct_ops")
struct tcp_congestion_ops untrusted_btf_write = {
.init = (void *)untrusted_btf_write_init,
.name = "bpf_ro_btf",
};