[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 32556ce93bc45c730829083cb60f95a2728ea48b
WARNING: Author mismatch between patch and upstream commit: Backport author: bin.lan.cn@eng.windriver.com Commit author: Daniel Borkmann daniel@iogearbox.net
Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.6.y | Present (different SHA1: a2c8dc7e2180) 6.1.y | Not found
Note: The patch differs from the upstream commit: --- 1: 32556ce93bc45 ! 1: 902e11e97536c bpf: Fix helper writes to read-only maps @@ Metadata ## Commit message ## bpf: Fix helper writes to read-only maps
+ [ Upstream commit 32556ce93bc45c730829083cb60f95a2728ea48b ] + Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT} @@ Commit message Acked-by: Shung-Hsi Yu shung-hsi.yu@suse.com Link: https://lore.kernel.org/r/20240913191754.13290-3-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov ast@kernel.org + [ Resolve merge conflict in include/linux/bpf.h and merge conflict in + kernel/bpf/verifier.c.] + Signed-off-by: Bin Lan bin.lan.cn@windriver.com
## include/linux/bpf.h ## @@ include/linux/bpf.h: enum bpf_type_flag { - /* DYNPTR points to xdp_buff */ - DYNPTR_TYPE_XDP = BIT(16 + BPF_BASE_TYPE_BITS), + /* Size is known at compile time. */ + MEM_FIXED_SIZE = BIT(10 + BPF_BASE_TYPE_BITS),
+ /* Memory must be aligned on some architectures, used in combination with + * MEM_FIXED_SIZE. @@ include/linux/bpf.h: enum bpf_arg_type { - ARG_PTR_TO_LONG, /* pointer to long */ ARG_PTR_TO_SOCKET, /* pointer to bpf_sock (fullsock) */ ARG_PTR_TO_BTF_ID, /* pointer to in-kernel struct */ - ARG_PTR_TO_RINGBUF_MEM, /* pointer to dynamically reserved ringbuf memory */ + ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
## kernel/bpf/helpers.c ## @@ kernel/bpf/helpers.c: const struct bpf_func_proto bpf_strtol_proto = { @@ kernel/bpf/verifier.c: static const struct bpf_reg_types mem_types = { - }, -}; - - static const struct bpf_reg_types spin_lock_types = { - .types = { - PTR_TO_MAP_VALUE, + static const struct bpf_reg_types fullsock_types = { .types = { PTR_TO_SOCKET } }; + static const struct bpf_reg_types scalar_types = { .types = { SCALAR_VALUE } }; + static const struct bpf_reg_types context_types = { .types = { PTR_TO_CTX } }; @@ kernel/bpf/verifier.c: static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = { [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types, [ARG_PTR_TO_MEM] = &mem_types, - [ARG_PTR_TO_RINGBUF_MEM] = &ringbuf_mem_types, + [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types, - [ARG_PTR_TO_INT] = &int_ptr_types, - [ARG_PTR_TO_LONG] = &int_ptr_types, [ARG_PTR_TO_PERCPU_BTF_ID] = &percpu_btf_ptr_types, @@ kernel/bpf/verifier.c: static int check_func_arg(struct bpf_verifier_env *env, u - } case ARG_PTR_TO_CONST_STR: { - err = check_reg_const_str(env, reg, regno); + struct bpf_map *map = reg->map_ptr;
## kernel/trace/bpf_trace.c ## @@ kernel/trace/bpf_trace.c: static const struct bpf_func_proto bpf_get_func_arg_proto = { ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.1.y | Success | Success |