bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM.
authorHao Luo <haoluo@google.com>
Thu, 28 Apr 2022 23:57:48 +0000 (16:57 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 1 May 2022 15:22:25 +0000 (17:22 +0200)
commit15166bb3000fc8b5faa8fa606eb25d300e6892ef
treef48d6265928e0b70388d403290539d1d549afee1
parentb710f73704d61069b2f05358309290551e5a8732
bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM.

commit 34d3a78c681e8e7844b43d1a2f4671a04249c821 upstream.

Tag the return type of {per, this}_cpu_ptr with RDONLY_MEM. The
returned value of this pair of helpers is kernel object, which
can not be updated by bpf programs. Previously these two helpers
return PTR_OT_MEM for kernel objects of scalar type, which allows
one to directly modify the memory. Now with RDONLY_MEM tagging,
the verifier will reject programs that write into RDONLY_MEM.

Fixes: 63d9b80dcf2c ("bpf: Introducte bpf_this_cpu_ptr()")
Fixes: eaa6bcb71ef6 ("bpf: Introduce bpf_per_cpu_ptr()")
Fixes: 4976b718c355 ("bpf: Introduce pseudo_btf_id")
Signed-off-by: Hao Luo <haoluo@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211217003152.48334-8-haoluo@google.com
Cc: stable@vger.kernel.org # 5.15.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/bpf/helpers.c
kernel/bpf/verifier.c