diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2022-11-25 14:06:17 -0800 |
|---|---|---|
| committer | Andrii Nakryiko <andrii@kernel.org> | 2022-11-30 15:33:48 -0800 |
| commit | c67cae551f0df80421b5703ee56ff5e2fe9c4de6 (patch) | |
| tree | cc1878eacd432087d36231fd8669971a5e963c70 /include/linux/bpf_verifier.h | |
| parent | 996c060e2bb90e5caef42849846b56da21ea88d9 (diff) | |
| download | lwn-c67cae551f0df80421b5703ee56ff5e2fe9c4de6.tar.gz lwn-c67cae551f0df80421b5703ee56ff5e2fe9c4de6.zip | |
bpf: Tighten ptr_to_btf_id checks.
The networking programs typically don't require CAP_PERFMON, but through kfuncs
like bpf_cast_to_kern_ctx() they can access memory through PTR_TO_BTF_ID. In
such case enforce CAP_PERFMON.
Also make sure that only GPL programs can access kernel data structures.
All kfuncs require GPL already.
Also remove allow_ptr_to_map_access. It's the same as allow_ptr_leaks and
different name for the same check only causes confusion.
Fixes: fd264ca02094 ("bpf: Add a kfunc to type cast from bpf uapi ctx to kernel ctx")
Fixes: 50c6b8a9aea2 ("selftests/bpf: Add a test for btf_type_tag "percpu"")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20221125220617.26846-1-alexei.starovoitov@gmail.com
Diffstat (limited to 'include/linux/bpf_verifier.h')
| -rw-r--r-- | include/linux/bpf_verifier.h | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index c05aa6e1f6f5..b5090e89cb3f 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -531,7 +531,6 @@ struct bpf_verifier_env { bool explore_alu_limits; bool allow_ptr_leaks; bool allow_uninit_stack; - bool allow_ptr_to_map_access; bool bpf_capable; bool bypass_spec_v1; bool bypass_spec_v4; |