[PATCH bpf v2 1/2] bpf: Reject writable map iterators on read-only maps

[Adethya Srinivasan <adethyasrinivasan@outlook.com>]

With CAP_BPF and CAP_PERFMON, an iterator program can write into a
frozen BPF_F_RDONLY_PROG array. The verifier treats the contents of
such an array as constants.

Reject writable map iterators on maps with BPF_F_RDONLY_PROG set.
Keep allowing read-only iterators.

Fixes: d3cc2ab546ad ("bpf: Implement bpf iterator for array maps")
Fixes: d6c4503cc296 ("bpf: Implement bpf iterator for hash maps")
Signed-off-by: Adethya Srinivasan <adethyasrinivasan@outlook.com>
---
 kernel/bpf/map_iter.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/map_iter.c b/kernel/bpf/map_iter.c
index a58c14869..7a769e5f5 100644
--- a/kernel/bpf/map_iter.c
+++ b/kernel/bpf/map_iter.c
@@ -99,8 +99,8 @@ static struct bpf_iter_reg bpf_map_reg_info = {
 
 /*
  * For an iterator that hands the live map value to the program as a writable
- * buffer: the verifier knows nothing of the map, so the special fields of the
- * value have to lie outside of what the program may write.
+ * buffer: the verifier knows nothing of the map, so read-only maps
+ * and special fields of the value have to be protected from writes.
  */
 int bpf_iter_map_check_value_write(const struct bpf_prog *prog,
 				   const struct bpf_map *map)
@@ -109,7 +109,13 @@ int bpf_iter_map_check_value_write(const struct bpf_prog *prog,
 	const struct btf_field *field;
 	u32 i;
 
-	if (IS_ERR_OR_NULL(rec) || !prog->aux->max_rdwr_write)
+	if (!prog->aux->max_rdwr_write)
+		return 0;
+
+	if (map->map_flags & BPF_F_RDONLY_PROG)
+		return -EACCES;
+
+	if (IS_ERR_OR_NULL(rec))
 		return 0;
 
 	for (i = 0; i < rec->cnt; i++) {