diff options
| author | Josef Bacik <josef@toxicpanda.com> | 2026-10-17 16:37:29 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-17 22:01:14 +0000 |
| commit | cd0490e671d70326d70c7d36e82388939fd9b071 (patch) | |
| tree | 42f3e62759c2f05e6b712216ec81297ba45fcb9f /kernel | |
| parent | 7cc639dc45c5d3b69acb2a2fc834e9eec51e0214 (diff) | |
bpf: Assume no bounds for a writable tp with tail calls
A writable raw tracepoint hands a buffer to the program. The verifier
notes how far the program reaches into it, and bpf_probe_register() refuses
a program that reaches further than the tracepoint allows. A program that
does not touch the buffer passes, and can tail-call one of its type that
reads and writes behind it.
Take a BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE program with a tail call to
reach as far as can be, as for the stack, the packet and the buffers of
iterators. It cannot be attached any more. Plain raw tracepoint programs,
for which the limit is zero, cannot get at the buffer, and a tail call
stays within one type: they are left alone.
Fixes: 9df1c28bb752 ("bpf: add writable context for raw tracepoints")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-28-alexei.starovoitov@gmail.com
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/fixups.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c index 002c3935a8eb..fe59e3114d82 100644 --- a/kernel/bpf/fixups.c +++ b/kernel/bpf/fixups.c @@ -2153,6 +2153,8 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env) prog->aux->max_pkt_offset = MAX_PACKET_OFF; prog->aux->max_rdonly_access = U32_MAX; prog->aux->max_rdwr_access = U32_MAX; + if (prog->type == BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE) + prog->aux->max_tp_access = U32_MAX; /* mark bpf_tail_call as different opcode to avoid * conditional branch in the interpreter for every normal |