Commit ac44dcc7 authored by Shuran Liu's avatar Shuran Liu Committed by Alexei Starovoitov
Browse files

bpf: Fix verifier assumptions of bpf_d_path's output buffer 



Commit 37cce22d ("bpf: verifier: Refactor helper access type
tracking") started distinguishing read vs write accesses performed by
helpers.

The second argument of bpf_d_path() is a pointer to a buffer that the
helper fills with the resulting path. However, its prototype currently
uses ARG_PTR_TO_MEM without MEM_WRITE.

Before 37cce22d, helper accesses were conservatively treated as
potential writes, so this mismatch did not cause issues. Since that
commit, the verifier may incorrectly assume that the buffer contents
are unchanged across the helper call and base its optimizations on this
wrong assumption. This can lead to misbehaviour in BPF programs that
read back the buffer, such as prefix comparisons on the returned path.

Fix this by marking the second argument of bpf_d_path() as
ARG_PTR_TO_MEM | MEM_WRITE so that the verifier correctly models the
write to the caller-provided buffer.

Fixes: 37cce22d ("bpf: verifier: Refactor helper access type tracking")
Co-developed-by: default avatarZesen Liu <ftyg@live.com>
Signed-off-by: default avatarZesen Liu <ftyg@live.com>
Co-developed-by: default avatarPeili Gao <gplhust955@gmail.com>
Signed-off-by: default avatarPeili Gao <gplhust955@gmail.com>
Co-developed-by: default avatarHaoran Ni <haoran.ni.cs@gmail.com>
Signed-off-by: default avatarHaoran Ni <haoran.ni.cs@gmail.com>
Signed-off-by: default avatarShuran Liu <electronlsr@gmail.com>
Reviewed-by: default avatarMatt Bobrowski <mattbobrowski@google.com>
Link: https://lore.kernel.org/r/20251206141210.3148-2-electronlsr@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 9489d457

kernel/trace/bpf_trace.c

+1 −1
Original line number Diff line number Diff line
@@ -965,7 +965,7 @@ static const struct bpf_func_proto bpf_d_path_proto = { 
	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_BTF_ID,

	.arg1_btf_id	= &bpf_d_path_btf_ids[0],

	.arg2_type	= ARG_PTR_TO_MEM,

	.arg2_type	= ARG_PTR_TO_MEM | MEM_WRITE,

	.arg3_type	= ARG_CONST_SIZE_OR_ZERO,

	.allowed	= bpf_d_path_allowed,

};