github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Check read access for helper input/output buffers

Browse Source 
MEM_WRITE without MEM_UNINIT denotes memory that is read as well as
written. Helper argument checking requests only BPF_WRITE for it, which
checks stack initialization but omits read permission checks on map values.
For example, bpf_check_mtu() reads its mtu_len argument before overwriting
it, but the verifier permits that argument to point into a BPF_F_WRONLY_PROG
map. bpf_fib_lookup() and bpf_load_hdr_opt() are affected the same way.

Derive generic memory access from argument flags: read-only for inputs,
write-only for MEM_WRITE | MEM_UNINIT, and read/write for MEM_WRITE alone.
Partial-output helpers such as bpf_snprintf() now carry MEM_UNINIT, so
their write-only map destinations remain valid. Generated kfunc prototypes
already encode the same distinction, which retires the kfunc-specific
access override.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260921023843.411943-11-memxor@gmail.com
This commit is contained in:
Eduard Zingerman 2026-09-21 04:38:34 +02:00 committed by Alexei Starovoitov
parent a25a61385b
commit 7a6cef39b7
No known key found for this signature in database
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
kernel/bpf/verifier.c
View File

@ -8907,6 +8907,19 @@ static int process_map_ptr_arg(struct bpf_verifier_env *env, struct bpf_reg_stat
return 0;
}
/*
* MEM_WRITE alone denotes an input/output buffer. MEM_UNINIT marks an output
* whose incoming contents are not read.
*/
static enum bpf_access_type func_arg_access_type(enum bpf_arg_type arg_type)
{
if (!(arg_type & MEM_WRITE))
return BPF_READ;
if (arg_type & MEM_UNINIT)
return BPF_WRITE;
return BPF_READ | BPF_WRITE;
}
static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 prev_slot,
struct bpf_call_arg_meta *meta,
int insn_idx)
@ -9199,10 +9212,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p
if (!(arg_type & MEM_FIXED_SIZE))
break;
access_type = arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ;
/* Ordinary kfunc buffers are input/output; __uninit buffers are outputs. */
if (meta->btf && !(arg_type & MEM_UNINIT))
access_type = BPF_READ | BPF_WRITE;
access_type = func_arg_access_type(arg_type);
err = check_mem_reg(env, reg, argno, arg_size, access_type, meta, &known_memory);
if (err < 0) {
@ -9248,9 +9258,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p
if (meta->btf && bpf_register_is_null(buff_reg))
break;
access_type = fn->arg_type[arg - 1] & MEM_WRITE ? BPF_WRITE : BPF_READ;
if (meta->btf && !(fn->arg_type[arg - 1] & MEM_UNINIT))
access_type = BPF_READ | BPF_WRITE;
access_type = func_arg_access_type(fn->arg_type[arg - 1]);
zero_size_allowed = meta->btf || base_type(arg_type) == ARG_MEM_SIZE_OR_ZERO;