bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write

BugLink: https://bugs.launchpad.net/bugs/2111953

[ Upstream commit 8ac412a3361173e3000b16167af3d1f6f90af613 ]

MEM_WRITE attribute is defined as: "Non-presence of MEM_WRITE means that
MEM is only being read". bpf_load_hdr_opt() both reads and writes from
its arg2 - void *search_res.

This matters a lot for the next commit where we more precisely track
stack accesses. Without this annotation, the verifier will make false
assumptions about the contents of memory written to by helpers and
possibly prune valid branches.

Fixes: 6fad274f06f0 ("bpf: Add MEM_WRITE attribute")
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Link: https://lore.kernel.org/r/730e45f8c39be2a5f3d8c4406cceca9d574cbf14.1736886479.git.dxu@dxuuu.xyz
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>

This commit is contained in:

Daniel Xu

2025-01-14 13:28:43 -07:00

committed by

Mehmet Basaran

parent b09402972e

commit 723cd5b47e

1 changed files with 1 additions and 1 deletions

									
										net/core/filter.c
									
		+1
		-1
	
												View File
												
				@@ -7629,7 +7629,7 @@ static const struct bpf_func_proto bpf_sock_ops_load_hdr_opt_proto = {

					.gpl_only	= false,

					.ret_type	= RET_INTEGER,

					.arg1_type	= ARG_PTR_TO_CTX,

					.arg2_type	= ARG_PTR_TO_MEM,

					.arg2_type	= ARG_PTR_TO_MEM | MEM_WRITE,

					.arg3_type	= ARG_CONST_SIZE,

					.arg4_type	= ARG_ANYTHING,

				};