Re: [PATCH bpf 2/2] bpf: Require ARG_PTR_TO_MEM with memory flag
From: bot+bpf-ci@kernel.org
Date: 2026-01-07 12:44:16
Also in:
bpf, linux-trace-kernel, lkml
quoted hunk ↗ jump to hunk
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index f0ca69f888fa..c7ebddb66385 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c@@ -10349,10 +10349,27 @@ static bool check_btf_id_ok(const struct bpf_func_proto *fn) return true; } +static bool check_mem_arg_rw_flag_ok(const struct bpf_func_proto *fn) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(fn->arg_type); i++) { + enum bpf_arg_type arg_type = fn->arg_type[i]; + + if (base_type(arg_type) != ARG_PTR_TO_MEM) + continue; + if (!(arg_type & (MEM_WRITE | MEM_RDONLY))) + return false;
Does this check also apply to ARG_PTR_TO_FIXED_SIZE_MEM? Looking at the
definition in include/linux/bpf.h:
ARG_PTR_TO_FIXED_SIZE_MEM = MEM_FIXED_SIZE | ARG_PTR_TO_MEM,
Since base_type() masks off the flags, base_type(ARG_PTR_TO_FIXED_SIZE_MEM)
returns ARG_PTR_TO_MEM. But ARG_PTR_TO_FIXED_SIZE_MEM does not include
MEM_WRITE or MEM_RDONLY in its definition.
Several helpers in net/core/filter.c use ARG_PTR_TO_FIXED_SIZE_MEM without
additional flags:
bpf_tcp_raw_gen_syncookie_ipv4_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
bpf_tcp_raw_gen_syncookie_ipv6_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
bpf_tcp_raw_check_syncookie_ipv4_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
.arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM,
bpf_tcp_raw_check_syncookie_ipv6_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
.arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM,
Would these helpers fail check_func_proto() after this change, causing
BPF programs using them to fail verification? Should these prototypes
be updated to include MEM_RDONLY (since they read from the memory), or
should the check skip ARG_PTR_TO_FIXED_SIZE_MEM?
+ } + + return true; +}
[ ... ] --- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20781625347