Re: [PATCH bpf 3/4] bpf: Require CAP_PERFMON for untrusted read-only memory reads

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Thu Sep 10, 2026 at 7:21 AM PDT, Daniel Borkmann wrote:
> Marking bpf_rdonly_cast() KF_PERFMON CAP-limits one producer of PTR_TO_MEM |
> MEM_RDONLY | PTR_UNTRUSTED, but not the type itself. A global subprogram
> argument tagged __arg_untrusted results in the same register with no kfunc
> call.
>
> Fixes: c4aa454c64ae ("bpf: support for void/primitive __arg_untrusted global func params")
> Reported-by: STAR Labs SG <info@starlabs.sg>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
>  kernel/bpf/verifier.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 5d61e74865a8..3f99b20e04fc 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -6453,6 +6453,16 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
>  			return -EACCES;
>  		}
>  
> +		if (rdonly_untrusted && !env->allow_ptr_leaks) {
> +			verbose(env, "%s access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN\n",
> +				reg_type_str(env, reg->type));
> +			bpf_diag_policy(
> +				env, insn_idx, "read from untrusted read-only memory",
> +				"the access requires CAP_PERFMON",
> +				"Load the program with CAP_PERFMON, or avoid dereferencing untrusted pointers.");

That's an odd formatting.
	bpf_diag_policy(env, insn_idx, "read from untrusted read-only memory",
			"the access requires CAP_PERFMON",

would look more normal.

pw-bot: cr