bpf: Allow uprobe program to change context registers

Currently uprobe (BPF_PROG_TYPE_KPROBE) program can't write to the
context registers data. While this makes sense for kprobe attachments,
for uprobe attachment it might make sense to be able to change user
space registers to alter application execution.

Since uprobe and kprobe programs share the same type (BPF_PROG_TYPE_KPROBE),
we can't deny write access to context during the program load. We need
to check on it during program attachment to see if it's going to be
kprobe or uprobe.

Storing the program's write attempt to context and checking on it
during the attachment.

Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20250916215301.664963-2-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ba3a3be7eb2a8a7ff587e9aa54275d0f7a09cc4c..ea2ed6771cc60c271783ee68502af07b5eaf400b 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1639,6 +1639,7 @@ struct bpf_prog_aux {
        bool priv_stack_requested;
        bool changes_pkt_data;
        bool might_sleep;
+       bool kprobe_write_ctx;
        u64 prog_array_member_cnt; /* counts how many times as member of prog_array */
        struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */
        struct bpf_arena *arena;

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 820127536e62b7e8ed1465cc4cf7a6e075ad52ea..1d354778dcd420c18ef07bcb6319edcc045794e3 100644 (file)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -11232,6 +11232,10 @@ static int __perf_event_set_bpf_prog(struct perf_event *event,
        if (prog->kprobe_override && !is_kprobe)
                return -EINVAL;
 
+       /* Writing to context allowed only for uprobes. */
+       if (prog->aux->kprobe_write_ctx && !is_uprobe)
+               return -EINVAL;
+
        if (is_tracepoint || is_syscall_tp) {
                int off = trace_event_get_offsets(event->tp_event);
 

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index f2360579658ead9846799a02828d6e4058511027..8f23f5273babf9a5d24f05f4a716dbf43a6ab951 100644 (file)
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1338,8 +1338,6 @@ static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type
 {
        if (off < 0 || off >= sizeof(struct pt_regs))
                return false;
-       if (type != BPF_READ)
-               return false;
        if (off % size != 0)
                return false;
        /*
@@ -1349,6 +1347,9 @@ static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type
        if (off + size > sizeof(struct pt_regs))
                return false;
 
+       if (type == BPF_WRITE)
+               prog->aux->kprobe_write_ctx = true;
+
        return true;
 }
 
@@ -2735,6 +2736,10 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
        if (!is_kprobe_multi(prog))
                return -EINVAL;
 
+       /* Writing to context is not allowed for kprobes. */
+       if (prog->aux->kprobe_write_ctx)
+               return -EINVAL;
+
        flags = attr->link_create.kprobe_multi.flags;
        if (flags & ~BPF_F_KPROBE_MULTI_RETURN)
                return -EINVAL;