From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4D22335BDB for ; Fri, 19 Jun 2026 20:05:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781899528; cv=none; b=f/hJYT3n2ZxPPAWDOAwxcz0BrXkXkNASyLFM9KUZe6eRUX7nUf5kzK1TJamzrftdlp5D41NCATNxyg0fIHFePdUAs/EsdwLqxvaaPxGEtG7DBgizJwRwij+WpA7YP6u+k/R0hTZqTVqPshth2srRAZ7tpDhYh52e4rLs9egmGaM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781899528; c=relaxed/simple; bh=0T4Z7K/rb2nHa13lr/ex8NbDdCu91yZhRTr7Sid9GFM=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=hNAtc+qpESyODV06N1At67NqHuFVaLTEhxmuYZPgf9evCf+0Z45AG0RN7KdhwJ8Gj+pgJCDTngINb6dETgH+Dpvxv0rlnTN8bDEi46eA9VcRDzEg8JCgWsp650lzBqXlXTr4ucS0Wa6tgZJZJYfROrIUs9gTwGcfvoCr1MzYbxA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=O4On/ejR; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="O4On/ejR" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2c6d4851142so20352305ad.1 for ; Fri, 19 Jun 2026 13:05:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781899527; x=1782504327; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=zH4OXFXG3GUtu3xSOVczzw0mmgwnoj/HVff9AySNWfk=; b=O4On/ejRCxff79FXdpvy8qxPlHq67Q/v64j/KfEDq7ma+IR6aJSodNYEVpXxJp2z8/ ZJTJCwJVzTAdv5HoCCVkTbdCDSw7XW6ukrd9rMm6sobdxTsmqHVQatZUPxqfqX9oZfXc BSAPxyFGSXe4dz+9iU8TaUHSc2kPL/zmoQEkHosdwXWgLxzXuo0SVxWGRFuCtDUeGazO WZQVrQska7zYxBkUBQXIDc+LIoa7A3sYc/YZ5o+SCcwKog58/5E2hQPhY5+19gplz+LU ORCQLy2MhqBUe/ZWEp84T2+tfj3WXGjBkNYhLPT4frlf7DL17UrAFLlh7F9JieHdfAKf JF8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781899527; x=1782504327; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zH4OXFXG3GUtu3xSOVczzw0mmgwnoj/HVff9AySNWfk=; b=br4syCi53Qx348YgGcFgMRyW2x+cx+Hkr2SQbQ5Cqb4ScWhKcpl/CLL2av0czsJDIT NbFeoAlVCIDwAeK46zBBu/NrX0gOPekBNC8YQ5zJ3UdI3MeyYE989yGHh9lB3Vw7lbwY cZGtfgpE8zrjszzeyb900w8U5KOggIZfEN87yW1y4MXJ1op2g1GikImAriMkTkJNHhwd ZoMoc3cklTv+uvqoAXEpuTDADbngmked+tUTXUqmecDx8omoOobLTxsislnPxjhP9XLl wnRfkj1v/MDsd0pluwVYDs0znNCfhhBKArkfj1xxH3aKGe87sO5LkkdRHbco3S30AJOo 6SWQ== X-Forwarded-Encrypted: i=1; AFNElJ8Z+tkG/qbDbEpDwgOhMDVn9IZ0BJyPEDyHgvyKMgb0vdUE3V4fiUgGUnU8pK7fTNSLH4UTmVtxKjDKK2o=@vger.kernel.org X-Gm-Message-State: AOJu0Yxlj5Y5Zn6o8LSHkClioueBeD5stmsFQW0XvgvhGiWDk/0Uo52q 6vMuEmn2Z+abrAF7911k5c0m+1gaRw4asAQ5B5Kq4Dte4Rv51Ar97aKm X-Gm-Gg: AfdE7cnF/zbjWLmJZWOT00Wvht707wAIIGFWS5Hr5h8g+b27f4Sk4jR4SF5V7/TP79b wlGgaJePI8HO1F2m2qbNy8hxSQDv3yfNIfyHjcKGFp4oJ28IVlbzy5jbZxp98YrW3uVUfIoAmP5 GHjt0E8dGPhrGeC3zSCBvxsDGoncBKbIggcW4eP8UySZXTfFqczN+idmcV6ISxwgWhd18duvXVI ZyYUbiLXgMgMzko7UUo0PeszaQ63MNl0M+LyvcTMvRje5n3kWDjq7Doo/cgKOfVpDlIyAoiM33/ Ham8tyIX2pcAThy3IXxc+WCHpNbs3pGnO6vJk9LcSciSgCWs/1hWq58juWiW2IcUKdxCzKrlNe7 bnI81jf14AzAd4f/4sJh1d6WSeQ3Zu2ZwF7JmtlbrBeht1BprhY6BZaIqLgkRNQRbDjv7d+Mr33 uscLNl2l46W8cwG0eMujT7m8Zlcj/qgD65c1wbTbA3LQ== X-Received: by 2002:a17:902:c401:b0:2bc:ac76:c1d0 with SMTP id d9443c01a7336-2c719626ed0mr40699335ad.17.1781899526920; Fri, 19 Jun 2026 13:05:26 -0700 (PDT) Received: from [192.168.0.226] ([38.34.87.7]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c7439f8d1dsm2592035ad.51.2026.06.19.13.05.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Jun 2026 13:05:25 -0700 (PDT) Message-ID: Subject: Re: [PATCH bpf-next 1/2] bpf: Require CAP_BPF for pseudo-BTF ksym loads From: Eduard Zingerman To: Nuoqi Gui , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Hao Luo Cc: John Fastabend , Martin KaFai Lau , Shuah Khan , bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Date: Fri, 19 Jun 2026 13:05:22 -0700 In-Reply-To: <20260620-f01-13-pseudo-btf-id-cap-bpf-v1-1-f950f69fe60c@mails.tsinghua.edu.cn> References: <20260620-f01-13-pseudo-btf-id-cap-bpf-v1-0-f950f69fe60c@mails.tsinghua.edu.cn> <20260620-f01-13-pseudo-btf-id-cap-bpf-v1-1-f950f69fe60c@mails.tsinghua.edu.cn> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.60.1 (3.60.1-1.fc44) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Sat, 2026-06-20 at 00:04 +0800, Nuoqi Gui wrote: > BPF_PSEUDO_BTF_ID is resolved before the main verifier pass. The resolver > looks up the referenced kernel symbol through kallsyms and rewrites the > ldimm64 immediate to the concrete address that later becomes verifier > state. >=20 > Require CAP_BPF before doing that materialization. This keeps typed ksym > address resolution on the privileged side and prevents loaders without > CAP_BPF from receiving a verifier log that contains the resolved address. >=20 > Fixes: 4976b718c3551 ("bpf: Introduce pseudo_btf_id") > Signed-off-by: Nuoqi Gui > --- > kernel/bpf/verifier.c | 5 +++++ > 1 file changed, 5 insertions(+) >=20 > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index ed7ba0e6a9ce..dbf5df995fc2 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -17639,6 +17639,11 @@ static int check_pseudo_btf_id(struct bpf_verifi= er_env *env, > int btf_fd; > int err; > =20 > + if (!env->bpf_capable) { > + verbose(env, "BPF_PSEUDO_BTF_ID loads require CAP_BPF\n"); > + return -EACCES; > + } > + Thank you for identifying this issue. I think the correct way to fix it is to extend the `is_ptr && !allow_ptr_le= aks` logic in kernel/bpf/disasm.c:print_bpf_insn(). Note that it seems there are additional cases that are not covered, something like below seem warranted: bool is_ptr =3D insn->src_reg =3D=3D BPF_PSEUDO_MAP_FD || insn->src_reg =3D=3D BPF_PSEUDO_MAP_VALUE || insn->src_reg =3D=3D BPF_PSEUDO_MAP_IDX || insn->src_reg =3D=3D BPF_PSEUDO_MAP_IDX_VALUE || insn->src_reg =3D=3D BPF_PSEUDO_BTF_ID; Could you please double check? > btf_fd =3D insn[1].imm; > if (btf_fd) { > btf =3D btf_get_by_fd(btf_fd);