Commit 19f4091b authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'a-pair-of-follow-ups-for-indirect-jumps'

Anton Protopopov says:

====================
A pair of follow ups for indirect jumps

Two fixes suggested by Alexei in [1]. Resending as a series,
as the second patch depends on the first.

  [1] https://lore.kernel.org/bpf/CAADnVQK3piReoo1ja=9hgz7aJ60Y_Jjur_JMOaYV8-Mn_VyE4A@mail.gmail.com/#R
====================

Link: https://patch.msgid.link/20251128063224.1305482-1-a.s.protopopov@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 688b7454 e3ea26ad
Loading
Loading
Loading
Loading
+3 −0
Original line number Diff line number Diff line
@@ -55,6 +55,9 @@ static struct bpf_map *insn_array_alloc(union bpf_attr *attr)

	bpf_map_init_from_attr(&insn_array->map, attr);

	/* BPF programs aren't allowed to write to the map */
	insn_array->map.map_flags |= BPF_F_RDONLY_PROG;

	return &insn_array->map;
}

+9 −10
Original line number Diff line number Diff line
@@ -6482,6 +6482,8 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
		break;
	case PTR_TO_MAP_VALUE:
		pointer_desc = "value ";
		if (reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY)
			strict = true;
		break;
	case PTR_TO_CTX:
		pointer_desc = "context ";
@@ -7529,8 +7531,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
{
	struct bpf_reg_state *regs = cur_regs(env);
	struct bpf_reg_state *reg = regs + regno;
	bool insn_array = reg->type == PTR_TO_MAP_VALUE &&
			  reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY;
	int size, err = 0;
	size = bpf_size_to_bytes(bpf_size);
@@ -7538,7 +7538,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
		return size;
	/* alignment checks will add in reg->off themselves */
	err = check_ptr_alignment(env, reg, off, size, strict_alignment_once || insn_array);
	err = check_ptr_alignment(env, reg, off, size, strict_alignment_once);
	if (err)
		return err;
@@ -7565,11 +7565,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
			verbose(env, "R%d leaks addr into map\n", value_regno);
			return -EACCES;
		}
		if (t == BPF_WRITE && insn_array) {
			verbose(env, "writes into insn_array not allowed\n");
			return -EACCES;
		}
		err = check_map_access_type(env, regno, off, size, t);
		if (err)
			return err;
@@ -7584,10 +7579,14 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
		} else if (t == BPF_READ && value_regno >= 0) {
			struct bpf_map *map = reg->map_ptr;
			/* if map is read-only, track its contents as scalars */
			/*
			 * If map is read-only, track its contents as scalars,
			 * unless it is an insn array (see the special case below)
			 */
			if (tnum_is_const(reg->var_off) &&
			    bpf_map_is_rdonly(map) &&
			    map->ops->map_direct_value_addr) {
			    map->ops->map_direct_value_addr &&
			    map->map_type != BPF_MAP_TYPE_INSN_ARRAY) {
				int map_off = off + reg->var_off.value;
				u64 val = 0;
+1 −1
Original line number Diff line number Diff line
@@ -244,7 +244,7 @@ jt0_%=: \
}

SEC("socket")
__failure __msg("writes into insn_array not allowed")
__failure __msg("write into map forbidden, value_size=16 off=8 size=8")
__naked void jump_table_no_writes(void)
{
	asm volatile ("						\