diff options
| author | Andrii Nakryiko <andriin@fb.com> | 2020-05-19 08:38:24 +0300 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2020-05-21 06:21:53 +0300 |
| commit | dfeb376dd4cb2c5004aeb625e2475f58a5ff2ea7 (patch) | |
| tree | 641c6f335575c230f294743042295a404e1e3aee /tools/testing/selftests/bpf/progs/test_mmap.c | |
| parent | 0550cfe8c2c6f8e7a4c348b6603a794576db12dd (diff) | |
| download | linux-dfeb376dd4cb2c5004aeb625e2475f58a5ff2ea7.tar.xz | |
bpf: Prevent mmap()'ing read-only maps as writable
As discussed in [0], it's dangerous to allow mapping BPF map, that's meant to
be frozen and is read-only on BPF program side, because that allows user-space
to actually store a writable view to the page even after it is frozen. This is
exacerbated by BPF verifier making a strong assumption that contents of such
frozen map will remain unchanged. To prevent this, disallow mapping
BPF_F_RDONLY_PROG mmap()'able BPF maps as writable, ever.
[0] https://lore.kernel.org/bpf/CAEf4BzYGWYhXdp6BJ7_=9OQPJxQpgug080MMjdSB72i9R+5c6g@mail.gmail.com/
Fixes: fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY")
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/bpf/20200519053824.1089415-1-andriin@fb.com
Diffstat (limited to 'tools/testing/selftests/bpf/progs/test_mmap.c')
| -rw-r--r-- | tools/testing/selftests/bpf/progs/test_mmap.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/tools/testing/selftests/bpf/progs/test_mmap.c b/tools/testing/selftests/bpf/progs/test_mmap.c index 6239596cd14e..4eb42cff5fe9 100644 --- a/tools/testing/selftests/bpf/progs/test_mmap.c +++ b/tools/testing/selftests/bpf/progs/test_mmap.c @@ -9,6 +9,14 @@ char _license[] SEC("license") = "GPL"; struct { __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, 4096); + __uint(map_flags, BPF_F_MMAPABLE | BPF_F_RDONLY_PROG); + __type(key, __u32); + __type(value, char); +} rdonly_map SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); __uint(max_entries, 512 * 4); /* at least 4 pages of data */ __uint(map_flags, BPF_F_MMAPABLE); __type(key, __u32); |