From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Suchit Karunakaran" <suchitkarunakaran@gmail.com>,
<daniel@iogearbox.net>, <andrii@kernel.org>, <eddyz87@gmail.com>,
<memxor@gmail.com>, <martin.lau@linux.dev>
Cc: <song@kernel.org>, <yonghong.song@linux.dev>, <jolsa@kernel.org>,
<emil@etsalapatis.com>, <ihor.solodrai@linux.dev>,
<john.fastabend@gmail.com>, <bpf@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2] bpf: add diagnostics for rejected memory and map accesses
Date: Mon, 28 Sep 2026 07:42:11 +0000 [thread overview]
Message-ID: <DLQS3VWUPXK9.NWD6AU4CU898@gmail.com> (raw)
In-Reply-To: <20260927194205.125086-1-suchitkarunakaran@gmail.com>
On Mon, Sep 28, 2026 at 01:12 AM Suchit Karunakaran <suchitkarunakaran@gmail.com> wrote:
> @@ -4472,12 +4472,22 @@ static int check_map_access_type(struct bpf_verifier_env *env, struct bpf_reg_st
> if (type == BPF_WRITE && !(cap & BPF_MAP_CAN_WRITE)) {
> verbose(env, "write into map forbidden, value_size=%d off=%lld size=%d\n",
> map->value_size, reg_smin(reg) + off, size);
> + bpf_diag_policy(env, env->insn_idx,
> + bpf_diag_fmt(env, "write to map '%s'",
> + map->name[0] ? map->name : "unnamed"),
> + "this map was created with BPF_F_RDONLY_PROG, which allows BPF programs to only read it",
> + "Remove the write, or create the map without BPF_F_RDONLY_PROG if BPF programs need to write to it.");
That's not true.
dev_map_init_map() and insn_array_alloc() set BPF_F_RDONLY_PROG
in the kernel for every devmap and insn_array.
libbpf sets it for .rodata when the prog has a const global.
The user didn't create the map with that flag and
cannot create it without.
Same in record_func_map().
[...]
> @@ -6944,6 +6954,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
> + "Use a writable destination, or copy the data into a writable buffer before modifying it.");
[...]
> @@ -7032,6 +7046,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
> + "Remove the direct write, or perform the modification in a program type and hook that support packet writes.");
These two are the same as in v1 and don't tell the user anything.
Pls focus your tokens elsewhere. I don't feel we will converge here.
pw-bot: cr
next prev parent reply other threads:[~2026-09-28 7:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-27 19:42 Suchit Karunakaran
2026-09-28 7:42 ` Alexei Starovoitov [this message]
2026-09-28 10:04 ` Suchit Karunakaran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DLQS3VWUPXK9.NWD6AU4CU898@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=song@kernel.org \
--cc=suchitkarunakaran@gmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®