diff options
| author | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2026-10-19 03:51:41 +0200 |
|---|---|---|
| committer | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2026-10-19 03:51:41 +0200 |
| commit | 44b6b1dfb259e8baa5226679945fb6c25d11c207 (patch) | |
| tree | 0b909a1f2278a0a1788fdffbff01158c410adb16 /rust/kernel/alloc/kvec/errors.rs | |
| parent | 0f9b1e9ef584522b645a97eff8d1c8d0dcab3afb (diff) | |
| parent | 71b6a960c73f2ccff0932ff70aaf066bc21a960c (diff) | |
Merge branch 'bpf-enforce-trusted-btf-id-argument-provenance'
Yiyang Chen says:
====================
bpf: Enforce trusted BTF ID argument provenance
A global subprogram parameter tagged __arg_trusted is verified with
PTR_TRUSTED, but its call-site type check also accepts bare PTR_TO_BTF_ID and
MEM_RCU registers. This lets a callee use a pointer with weaker provenance
under the trusted-pointer contract, including passing it to a non-KF_RCU
kfunc.
Encode the trusted-pointer requirement in generated kfunc prototypes and
drive the shared provenance check from the argument contract. A KF_RCU
kfunc additionally permits MEM_RCU, while a global __arg_trusted argument
requires a referenced or trusted pointer. Normalize nullability when the
argument contract permits it.
Add rejection coverage for bare and RCU-protected global-subprogram arguments
and acceptance coverage for a nullable kfunc receiving a trusted nullable
pointer.
A separate scx_cake caller fix has been prepared but is not yet submitted.
The current veristat-scx pin still uses the old caller, which this series
rejects.
Changes in v4:
- Rebase onto bpf-next and use the shared argument checker.
- Reject MEM_RCU for global __arg_trusted arguments.
- Encode trusted and KF_RCU provenance in generated kfunc prototypes.
- Add nullable-kfunc coverage and use a 12-character Fixes SHA.
- Link to v3: https://lore.kernel.org/r/20261006-a3-arg-trusted-v4-v3-0-4619daf30e1c@mails.tsinghua.edu.cn
Changes in v3:
- Preserve RCU-protected arguments accepted by existing sched-ext programs.
- Make the MEM_RCU case a positive regression test.
- Use the preferred multi-line comment style.
- Link to v2: https://lore.kernel.org/r/20261005-a3-arg-trusted-v4-v2-0-319ce2936949@mails.tsinghua.edu.cn
Changes in v2:
- Retarget the fix to btf_check_func_arg_match(), where the subprogram
argument check lives in this tree, instead of check_func_arg().
- Run the check after check_reg_type() and check_func_arg_reg_off() so type
and offset diagnostics keep their wording.
v1: https://lore.kernel.org/bpf/20261005-a3-arg-trusted-v4-v1-0-50ee0268fd39@mails.tsinghua.edu.cn/
---
====================
Link: https://patch.msgid.link/20261007-a3-arg-trusted-v4-v4-0-253ef3a1a69a@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Diffstat (limited to 'rust/kernel/alloc/kvec/errors.rs')
0 files changed, 0 insertions, 0 deletions
