diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2025-11-28 15:15:43 -0800 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2025-11-28 15:15:43 -0800 |
| commit | 19f4091bf2679759da877eb23a37863dc4368441 (patch) | |
| tree | aa3809c6b04559da7746da4c2e9b8e426c10172c | |
| parent | 688b745401ab16e2e1a3b504863f0a45fd345638 (diff) | |
| parent | e3ea26add687ec6829fd8e7161b17667fdb88ec1 (diff) | |
Merge branch 'a-pair-of-follow-ups-for-indirect-jumps'
Anton Protopopov says:
====================
A pair of follow ups for indirect jumps
Two fixes suggested by Alexei in [1]. Resending as a series,
as the second patch depends on the first.
[1] https://lore.kernel.org/bpf/CAADnVQK3piReoo1ja=9hgz7aJ60Y_Jjur_JMOaYV8-Mn_VyE4A@mail.gmail.com/#R
====================
Link: https://patch.msgid.link/20251128063224.1305482-1-a.s.protopopov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
| -rw-r--r-- | kernel/bpf/bpf_insn_array.c | 3 | ||||
| -rw-r--r-- | kernel/bpf/verifier.c | 19 | ||||
| -rw-r--r-- | tools/testing/selftests/bpf/progs/verifier_gotox.c | 2 |
3 files changed, 13 insertions, 11 deletions
diff --git a/kernel/bpf/bpf_insn_array.c b/kernel/bpf/bpf_insn_array.c index 61ce52882632..c96630cb75bf 100644 --- a/kernel/bpf/bpf_insn_array.c +++ b/kernel/bpf/bpf_insn_array.c @@ -55,6 +55,9 @@ static struct bpf_map *insn_array_alloc(union bpf_attr *attr) bpf_map_init_from_attr(&insn_array->map, attr); + /* BPF programs aren't allowed to write to the map */ + insn_array->map.map_flags |= BPF_F_RDONLY_PROG; + return &insn_array->map; } diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 766695491bc5..f0ca69f888fa 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -6482,6 +6482,8 @@ static int check_ptr_alignment(struct bpf_verifier_env *env, break; case PTR_TO_MAP_VALUE: pointer_desc = "value "; + if (reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY) + strict = true; break; case PTR_TO_CTX: pointer_desc = "context "; @@ -7529,8 +7531,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn { struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; - bool insn_array = reg->type == PTR_TO_MAP_VALUE && - reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY; int size, err = 0; size = bpf_size_to_bytes(bpf_size); @@ -7538,7 +7538,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return size; /* alignment checks will add in reg->off themselves */ - err = check_ptr_alignment(env, reg, off, size, strict_alignment_once || insn_array); + err = check_ptr_alignment(env, reg, off, size, strict_alignment_once); if (err) return err; @@ -7565,11 +7565,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn verbose(env, "R%d leaks addr into map\n", value_regno); return -EACCES; } - if (t == BPF_WRITE && insn_array) { - verbose(env, "writes into insn_array not allowed\n"); - return -EACCES; - } - err = check_map_access_type(env, regno, off, size, t); if (err) return err; @@ -7584,10 +7579,14 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn } else if (t == BPF_READ && value_regno >= 0) { struct bpf_map *map = reg->map_ptr; - /* if map is read-only, track its contents as scalars */ + /* + * If map is read-only, track its contents as scalars, + * unless it is an insn array (see the special case below) + */ if (tnum_is_const(reg->var_off) && bpf_map_is_rdonly(map) && - map->ops->map_direct_value_addr) { + map->ops->map_direct_value_addr && + map->map_type != BPF_MAP_TYPE_INSN_ARRAY) { int map_off = off + reg->var_off.value; u64 val = 0; diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c index 536c9f3e2170..607dad058ca1 100644 --- a/tools/testing/selftests/bpf/progs/verifier_gotox.c +++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c @@ -244,7 +244,7 @@ jt0_%=: \ } SEC("socket") -__failure __msg("writes into insn_array not allowed") +__failure __msg("write into map forbidden, value_size=16 off=8 size=8") __naked void jump_table_no_writes(void) { asm volatile (" \ |