Skip to content

Commit 934b7aa

Browse files
bpf: Specify access type of bpf_sysctl_get_name args
JIRA: https://issues.redhat.com/browse/RHEL-93930 commit 2eb7648 Author: Jerome Marchand <jmarchan@redhat.com> Date: Thu Jun 19 16:06:02 2025 +0200 bpf: Specify access type of bpf_sysctl_get_name args The second argument of bpf_sysctl_get_name() helper is a pointer to a buffer that is being written to. However that isn't specify in the prototype. Until commit 37cce22 ("bpf: verifier: Refactor helper access type tracking"), all helper accesses were considered as a possible write access by the verifier, so no big harm was done. However, since then, the verifier might make wrong asssumption about the content of that address which might lead it to make faulty optimizations (such as removing code that was wrongly labeled dead). This is what happens in test_sysctl selftest to the tests related to sysctl_get_name. Add MEM_WRITE flag the second argument of bpf_sysctl_get_name(). Signed-off-by: Jerome Marchand <jmarchan@redhat.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20250619140603.148942-2-jmarchan@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
1 parent 1840239 commit 934b7aa

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

kernel/bpf/cgroup.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2087,7 +2087,7 @@ static const struct bpf_func_proto bpf_sysctl_get_name_proto = {
20872087
.gpl_only = false,
20882088
.ret_type = RET_INTEGER,
20892089
.arg1_type = ARG_PTR_TO_CTX,
2090-
.arg2_type = ARG_PTR_TO_MEM,
2090+
.arg2_type = ARG_PTR_TO_MEM | MEM_WRITE,
20912091
.arg3_type = ARG_CONST_SIZE,
20922092
.arg4_type = ARG_ANYTHING,
20932093
};

0 commit comments

Comments
 (0)