github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-26 18:12:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Require CAP_PERFMON for untrusted read-only memory reads

Browse Source 
Marking bpf_rdonly_cast() KF_PERFMON CAP-limits one producer of PTR_TO_MEM |
MEM_RDONLY | PTR_UNTRUSTED, but not the type itself. A global subprogram
argument tagged __arg_untrusted results in the same register with no kfunc
call.

Reported-by: STAR Labs SG <info@starlabs.sg>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260910213510.49358-3-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Daniel Borkmann 2026-09-10 23:35:09 +02:00 committed by Alexei Starovoitov
parent 81c975aae3
commit f9191460cd
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
kernel/bpf/verifier.c
View File

@ -6453,6 +6453,15 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
return -EACCES;
}
if (rdonly_untrusted && !env->allow_ptr_leaks) {
verbose(env, "%s access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN\n",
reg_type_str(env, reg->type));
bpf_diag_policy(env, insn_idx, "read from untrusted read-only memory",
"the access requires CAP_PERFMON",
"Load the program with CAP_PERFMON, or avoid dereferencing untrusted pointers.");
return -EPERM;
}
/*
* Accesses to untrusted PTR_TO_MEM are done through probe
* instructions, hence no need to check bounds in that case.