diff options
| author | Amery Hung <ameryhung@gmail.com> | 2026-09-28 11:53:33 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-09-29 10:35:12 +0000 |
| commit | 46e0744621081c25fe3ccf4e4c270ca2844e7dff (patch) | |
| tree | dd127c360663ddbb1e167f16f673cadf2cf95393 /include | |
| parent | 77d9384a69cdbaeaf97eca8c624c47436703e76d (diff) | |
| download | linux-next-46e0744621081c25fe3ccf4e4c270ca2844e7dff.tar.gz linux-next-46e0744621081c25fe3ccf4e4c270ca2844e7dff.zip | |
bpf: Check global subprog memory arguments in the common path
Route fixed-size global ARG_PTR_TO_MEM arguments through
check_func_arg(). Preserve their read-write access check, nullable
contract, and support for BTF-defined allocated memory.
Recognize subprog calls explicitly in the common checker. Global
subprog stack liveness can prove that bytes in an argument are unused
by the callee. Retain the existing allowance for those poisoned stack
bytes when call metadata is present, and update the nullability log
expectation.
The verifier also rejects packet pointers when the callee may change
packet data. The concrete packet-backed register state is only available
while checking the call site; the independently verified callee sees
generic PTR_TO_MEM. Record this property as subprog_may_change_pkt in
subprog-only call metadata and retain the packet-pointer rejection in the
common fixed-memory path.
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260928185334.1004200-11-ameryhung@gmail.com
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/bpf_verifier.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 183759f1e014..811342e3c041 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -1656,6 +1656,9 @@ struct bpf_call_arg_meta { struct ret_mem_desc ret_mem; struct arg_raw_mem_desc arg_raw_mem; + /* Only set by subprog */ + bool subprog_may_change_pkt; + /* Only set by kfunc */ bool r0_rdonly; u32 kfunc_flags; |