Re: [PATCH bpf-next v2 2/6] bpf: Treat a fault prone PTR_TO_MEM as a pointer type mismatch
Eduard Zingerman <[email protected]>
| Newsgroups | org.kernel.vger.bpf |
|---|---|
| Message-ID | <[email protected]> |
On Fri, 2026-08-14 at 23:52 +0200, Daniel Borkmann wrote:
> reg_type_mismatch_ok() enumerates the pointer types which must not
> silently share a BPF_LDX with a different one, since the type recorded
> for the insn drives a rewrite in bpf_convert_ctx_accesses().
>
> f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()") added
> PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED as another type in need of one,
> namely the BPF_PROBE_MEM rewrite, but did not add it there. Fix it by
> adding the missing case to reg_type_mismatch_ok(), so that a PTR_TO_MEM
> which may fault on deref is not mismatch ok anymore. The triage in
> save_aux_ptr_type() then merges them.
>
> Fixes: f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()")
> Signed-off-by: Daniel Borkmann <[email protected]>
> ---
> v1 -> v2:
> - new patch to address PTR_TO_MEM case differently (Eduard)
Acked-by: Eduard Zingerman <[email protected]>