diff options
| author | KP Singh <kpsingh@kernel.org> | 2025-09-15 00:51:30 +0300 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2025-09-19 05:10:20 +0300 |
| commit | 603b4416232524dafde8e2cf859788dae786dea1 (patch) | |
| tree | 5ba8d6c36180b395c322e68aac4d116c6e36fe91 /include/linux | |
| parent | 3547a61ee2fe8f1fc46d4326a9517d97ae3614cd (diff) | |
| download | linux-603b4416232524dafde8e2cf859788dae786dea1.tar.xz | |
bpf: Update the bpf_prog_calc_tag to use SHA256
Exclusive maps restrict map access to specific programs using a hash.
The current hash used for this is SHA1, which is prone to collisions.
This patch uses SHA256, which is more resilient against
collisions. This new hash is stored in bpf_prog and used by the verifier
to determine if a program can access a given exclusive map.
The original 64-bit tags are kept, as they are used by users as a short,
possibly colliding program identifier for non-security purposes.
Signed-off-by: KP Singh <kpsingh@kernel.org>
Link: https://lore.kernel.org/r/20250914215141.15144-2-kpsingh@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/bpf.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 41f776071ff5..d75902074bd1 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -31,6 +31,7 @@ #include <linux/memcontrol.h> #include <linux/cfi.h> #include <asm/rqspinlock.h> +#include <crypto/sha2.h> struct bpf_verifier_env; struct bpf_verifier_log; @@ -1717,7 +1718,10 @@ struct bpf_prog { enum bpf_attach_type expected_attach_type; /* For some prog types */ u32 len; /* Number of filter blocks */ u32 jited_len; /* Size of jited insns in bytes */ - u8 tag[BPF_TAG_SIZE]; + union { + u8 digest[SHA256_DIGEST_SIZE]; + u8 tag[BPF_TAG_SIZE]; + }; struct bpf_prog_stats __percpu *stats; int __percpu *active; unsigned int (*bpf_func)(const void *ctx, |