github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Unclone the skb for kfuncs that write through a dynptr

Browse Source 
bpf_dynptr_copy(), bpf_dynptr_memset() and the kfuncs that read user or
kernel memory into a dynptr ask bpf_dynptr_slice_rdwr() for a slice and
write to it.  For the linear part of an skb that is a pointer into its
head.  bpf_dynptr_slice_rdwr() counts on the verifier to have uncloned the
skb, see bpf_unclone_prologue().

The verifier does so if the program itself calls bpf_dynptr_slice_rdwr()
or writes to the packet.  A program that only uses these kfuncs gets no
prologue, and changes the data of all the clones of the skb.  A packet
socket, whose clone is taken before tc ingress runs, sees what
bpf_dynptr_memset() has written there.

Treat a call that may write to an skb like a direct write.

Fixes: daec295a70 ("bpf/helpers: Introduce bpf_dynptr_copy kfunc")
Fixes: a498ee7576 ("bpf: Implement dynptr copy kfuncs")
Fixes: 5fc5d8fded ("bpf: Add bpf_dynptr_memset() kfunc")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017230950.802052-13-alexei.starovoitov@gmail.com
This commit is contained in:
Alexei Starovoitov 2026-10-17 23:09:46 +00:00
parent aa486cff49
commit bb72c28668
No known key found for this signature in database
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
kernel/bpf/verifier.c
View File

@ -15683,6 +15683,14 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
bpf_is_kfunc_pkt_changing(&meta))
clear_all_pkt_pointers(env);
/*
* These kfuncs write to the head of the skb in place if what they write
* to is linear. Like a direct write that takes bpf_unclone_prologue().
*/
if (is_kfunc_dynptr_write(&meta) &&
dynptr_write_changes_pkt_data(meta.dynptr_write_type))
may_access_direct_pkt_data(env, NULL, BPF_WRITE);
proto_slots = kfunc_abi_slots(&desc->func_model);
if (proto_slots > MAX_BPF_FUNC_REG_ARGS) {
struct bpf_func_state *caller = cur_func(env);