diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2026-10-20 00:15:54 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-20 00:15:55 +0000 |
| commit | 2ad9c9142d59f5748cce5da44ec46a14fdb66467 (patch) | |
| tree | a3469e8e8c787fbe0df8357b721fe7fc4beee4fa /kernel | |
| parent | b2914fb67fbbfcd7ab1a855c167595b363212613 (diff) | |
| parent | 25a2e54999b0b93e8ecebb5863e3ecbcafb0ed18 (diff) | |
Merge branch 'refuse-co-re-relocations-for-a-signed-program'
Kumar Kartikeya Dwivedi says:
====================
Refuse CO-RE relocations for a signed program
The signature of a BPF program is checked over the insns as submitted,
but the loader may also hand in CO-RE relocation records, which the
kernel applies to those insns afterwards with values the loader picks
through its BTF. Whoever holds a signed program can so change its
constants once the signature has passed. Refuse relocations on a signed
load, before the signature is examined, and test it.
Found by Sashiko on the "Fix some arena paper cuts" series:
https://lore.kernel.org/bpf/sashiko-outbox-176588@kernel.org/
====================
Link: https://patch.msgid.link/20261019144851.4052056-1-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 264da570a0a5..01434e1d23b5 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23501,6 +23501,15 @@ static int bpf_prog_verify_signature(struct bpf_verifier_env *env, u64 data_sz; int err = 0; + /* + * The signature covers the insns as submitted. CO-RE relocations would + * have the kernel rewrite them afterwards, with values the loader picks + * through the BTF it supplies, see bpf_check_core_relo(). + */ + if (attr->core_relo_cnt) { + verbose(env, "signed program cannot carry CO-RE relocations\n"); + return -EACCES; + } if (!attr->signature_size || attr->signature_size > BPF_PROG_MAX_SIGNATURE_SIZE) return -EINVAL; |