From nobody Thu Oct 9 09:03:17 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 093A128B4EE for ; Thu, 19 Jun 2025 14:06:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750341983; cv=none; b=N2XfemBV1w9KMiQPhstETSV5wVC1wDlUTbCdA0P3cB0lXxVRgG01vwNRuDjbZpSnYrDb3NBpKiOi8nBpdjnryEidJ6vFDqBCtIbYIVBqkCqKvycSYLvoJDB7wlQJ0thtpE0XCKIZajxX9+Mv93wbOHky5g4N+7V3P++X/SotAJc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750341983; c=relaxed/simple; bh=ltjpKWi1t7lbiS/wQUL0JGtR6xxe81f0cE/kMQ+SMZ0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HXRWyUUIKRDwZxUlW+YEr8tL9aMdJrZzajo7VyL0lTxhvvC3mcieJozbnyLPZv7BHbs46DkVGKUdty1ThqSytUMCOJHuPhHWJii/hi0Kp8ZWsRs2xj3lRGxZ7tFvBjm8tphmxjp7buj2YQv1pY7hAtReqUgoNb5GOeNrPANoDRM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=GVdHzqxm; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="GVdHzqxm" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1750341981; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=QIyeiHyJh2LLkv/UD+/4q8cYY7zOw5NP6NFKW3iCjws=; b=GVdHzqxmcEDp2pejM78fTfSEPvwfjCZdWfEV/d4uWCH4tE5ZhsldixyBCueLXxTpmSfzHk Ev5qZQY90ZmwA1rOkIZk9b7mqjf05WzdhKjDD3+YWEb9JC4VUPKCnKS+IbyH+EhlGhZLUs SCYa+odqbGCwHBuwMsw6GNvnf6yVW5k= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-553-ltaj88ZnMCGh-96liPa8EA-1; Thu, 19 Jun 2025 10:06:17 -0400 X-MC-Unique: ltaj88ZnMCGh-96liPa8EA-1 X-Mimecast-MFC-AGG-ID: ltaj88ZnMCGh-96liPa8EA_1750341976 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2287A1809C80; Thu, 19 Jun 2025 14:06:16 +0000 (UTC) Received: from fedora (unknown [10.45.226.41]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with SMTP id CCD93195609D; Thu, 19 Jun 2025 14:06:11 +0000 (UTC) Received: by fedora (sSMTP sendmail emulation); Thu, 19 Jun 2025 16:06:10 +0200 From: "Jerome Marchand" To: bpf@vger.kernel.org Cc: Martin KaFai Lau , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Yonghong Song , Eduard Zingerman , linux-kernel@vger.kernel.org, Jerome Marchand Subject: [PATCH v3 1/2] bpf: Specify access type of bpf_sysctl_get_name args Date: Thu, 19 Jun 2025 16:06:02 +0200 Message-ID: <20250619140603.148942-2-jmarchan@redhat.com> In-Reply-To: <20250619140603.148942-1-jmarchan@redhat.com> References: <20250619140603.148942-1-jmarchan@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" The second argument of bpf_sysctl_get_name() helper is a pointer to a buffer that is being written to. However that isn't specify in the prototype. Until commit 37cce22dbd51a ("bpf: verifier: Refactor helper access type tracking"), all helper accesses were considered as a possible write access by the verifier, so no big harm was done. However, since then, the verifier might make wrong asssumption about the content of that address which might lead it to make faulty optimizations (such as removing code that was wrongly labeled dead). This is what happens in test_sysctl selftest to the tests related to sysctl_get_name. Add MEM_WRITE flag the second argument of bpf_sysctl_get_name(). Signed-off-by: Jerome Marchand Acked-by: Yonghong Song --- kernel/bpf/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 84f58f3d028a3..76994c204b503 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -2104,7 +2104,7 @@ static const struct bpf_func_proto bpf_sysctl_get_nam= e_proto =3D { .gpl_only =3D false, .ret_type =3D RET_INTEGER, .arg1_type =3D ARG_PTR_TO_CTX, - .arg2_type =3D ARG_PTR_TO_MEM, + .arg2_type =3D ARG_PTR_TO_MEM | MEM_WRITE, .arg3_type =3D ARG_CONST_SIZE, .arg4_type =3D ARG_ANYTHING, }; --=20 2.49.0