From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C684C3101BB; Mon, 29 Dec 2025 16:15:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767024903; cv=none; b=ESf1lI+PRB/jIc8wZFFaq7Rvyaba+rj85cAccg89ZM5d6E+3KUPwnA6nngJnpnYRgrLvC1kmKM0Ck+GSuLBQm6Yb+dA8vopoQrZtN/94aLKybQY+wSeVThz37X2qVdDieCiW/YWH78KbMCPgyyu2sX5rJd/DcMP7UJqTcBUjBTc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767024903; c=relaxed/simple; bh=WzcrJeMYg1GPqTfFmbyyRK+AWnFhLySP4esA3YfMCgE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ruOIibszU9WPi51Y88xdi5+xlvq7zSBtQF1ClZQTFdsXt727SSRopIRTazLFVHoyUcrLnOL7QaqakltpAZK7OBvkZ2v8oYAVLL7QiCUZrxGQ+v3R398EppCLB786fLwDUFezXMCTNNDVURyYfOJ5UZ0Us2MI2jZF46t8qSJHzx0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EsnLwMSI; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="EsnLwMSI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E44FFC19421; Mon, 29 Dec 2025 16:15:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1767024902; bh=WzcrJeMYg1GPqTfFmbyyRK+AWnFhLySP4esA3YfMCgE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EsnLwMSIe+9o0yk3NOAGQxTiGPCCVfqszdtBpGZOORlWpCKoL2H2t7bRww0PIsNk6 4+W5Ov9DQvLFYIXjL+ZdHp62D/M3R9arUsrxsRjFxlDmvR4PS0c6LMaoZTwUUEvT4/ bG/6wxsMeunOmbydrW5Pk1J+OX0B6o05wel6P+RU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Zesen Liu , Peili Gao , Haoran Ni , Shuran Liu , Matt Bobrowski , Alexei Starovoitov , Sasha Levin Subject: [PATCH 6.18 005/430] bpf: Fix verifier assumptions of bpf_d_paths output buffer Date: Mon, 29 Dec 2025 17:06:47 +0100 Message-ID: <20251229160724.346930168@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251229160724.139406961@linuxfoundation.org> References: <20251229160724.139406961@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shuran Liu [ Upstream commit ac44dcc788b950606793e8f9690c30925f59df02 ] Commit 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking") started distinguishing read vs write accesses performed by helpers. The second argument of bpf_d_path() is a pointer to a buffer that the helper fills with the resulting path. However, its prototype currently uses ARG_PTR_TO_MEM without MEM_WRITE. Before 37cce22dbd51, helper accesses were conservatively treated as potential writes, so this mismatch did not cause issues. Since that commit, the verifier may incorrectly assume that the buffer contents are unchanged across the helper call and base its optimizations on this wrong assumption. This can lead to misbehaviour in BPF programs that read back the buffer, such as prefix comparisons on the returned path. Fix this by marking the second argument of bpf_d_path() as ARG_PTR_TO_MEM | MEM_WRITE so that the verifier correctly models the write to the caller-provided buffer. Fixes: 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking") Co-developed-by: Zesen Liu Signed-off-by: Zesen Liu Co-developed-by: Peili Gao Signed-off-by: Peili Gao Co-developed-by: Haoran Ni Signed-off-by: Haoran Ni Signed-off-by: Shuran Liu Reviewed-by: Matt Bobrowski Link: https://lore.kernel.org/r/20251206141210.3148-2-electronlsr@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin --- kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 4f87c16d915a0..49e0bdaa7a1bf 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -965,7 +965,7 @@ static const struct bpf_func_proto bpf_d_path_proto = { .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_BTF_ID, .arg1_btf_id = &bpf_d_path_btf_ids[0], - .arg2_type = ARG_PTR_TO_MEM, + .arg2_type = ARG_PTR_TO_MEM | MEM_WRITE, .arg3_type = ARG_CONST_SIZE_OR_ZERO, .allowed = bpf_d_path_allowed, }; -- 2.51.0