Re: [PATCH 6.1] bpf: Fix helper writes to read-only maps

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 32556ce93bc45c730829083cb60f95a2728ea48b

WARNING: Author mismatch between patch and upstream commit:
Backport author: bin.lan.cn@eng.windriver.com
Commit author: Daniel Borkmann <daniel@iogearbox.net>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: a2c8dc7e2180)
6.1.y | Not found

Note: The patch differs from the upstream commit:
---
1:  32556ce93bc45 ! 1:  902e11e97536c bpf: Fix helper writes to read-only maps
    @@ Metadata
      ## Commit message ##
         bpf: Fix helper writes to read-only maps
     
    +    [ Upstream commit 32556ce93bc45c730829083cb60f95a2728ea48b ]
    +
         Lonial found an issue that despite user- and BPF-side frozen BPF map
         (like in case of .rodata), it was still possible to write into it from
         a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT}
    @@ Commit message
         Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
         Link: https://lore.kernel.org/r/20240913191754.13290-3-daniel@iogearbox.net
         Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    +    [ Resolve merge conflict in include/linux/bpf.h and merge conflict in
    +      kernel/bpf/verifier.c.]
    +    Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
     
      ## include/linux/bpf.h ##
     @@ include/linux/bpf.h: enum bpf_type_flag {
    - 	/* DYNPTR points to xdp_buff */
    - 	DYNPTR_TYPE_XDP		= BIT(16 + BPF_BASE_TYPE_BITS),
    + 	/* Size is known at compile time. */
    + 	MEM_FIXED_SIZE		= BIT(10 + BPF_BASE_TYPE_BITS),
      
     +	/* Memory must be aligned on some architectures, used in combination with
     +	 * MEM_FIXED_SIZE.
    @@ include/linux/bpf.h: enum bpf_arg_type {
     -	ARG_PTR_TO_LONG,	/* pointer to long */
      	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock (fullsock) */
      	ARG_PTR_TO_BTF_ID,	/* pointer to in-kernel struct */
    - 	ARG_PTR_TO_RINGBUF_MEM,	/* pointer to dynamically reserved ringbuf memory */
    + 	ARG_PTR_TO_ALLOC_MEM,	/* pointer to dynamically allocated memory */
     
      ## kernel/bpf/helpers.c ##
     @@ kernel/bpf/helpers.c: const struct bpf_func_proto bpf_strtol_proto = {
    @@ kernel/bpf/verifier.c: static const struct bpf_reg_types mem_types = {
     -	},
     -};
     -
    - static const struct bpf_reg_types spin_lock_types = {
    - 	.types = {
    - 		PTR_TO_MAP_VALUE,
    + static const struct bpf_reg_types fullsock_types = { .types = { PTR_TO_SOCKET } };
    + static const struct bpf_reg_types scalar_types = { .types = { SCALAR_VALUE } };
    + static const struct bpf_reg_types context_types = { .types = { PTR_TO_CTX } };
     @@ kernel/bpf/verifier.c: static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = {
      	[ARG_PTR_TO_SPIN_LOCK]		= &spin_lock_types,
      	[ARG_PTR_TO_MEM]		= &mem_types,
    - 	[ARG_PTR_TO_RINGBUF_MEM]	= &ringbuf_mem_types,
    + 	[ARG_PTR_TO_ALLOC_MEM]		= &alloc_mem_types,
     -	[ARG_PTR_TO_INT]		= &int_ptr_types,
     -	[ARG_PTR_TO_LONG]		= &int_ptr_types,
      	[ARG_PTR_TO_PERCPU_BTF_ID]	= &percpu_btf_ptr_types,
    @@ kernel/bpf/verifier.c: static int check_func_arg(struct bpf_verifier_env *env, u
     -	}
      	case ARG_PTR_TO_CONST_STR:
      	{
    - 		err = check_reg_const_str(env, reg, regno);
    + 		struct bpf_map *map = reg->map_ptr;
     
      ## kernel/trace/bpf_trace.c ##
     @@ kernel/trace/bpf_trace.c: static const struct bpf_func_proto bpf_get_func_arg_proto = {
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |