On Mon Aug 3, 2026 at 5:21 AM CEST, Ning Ding wrote:
>> Second, I don't understand your explanation. WDYM by "after the access
>> permission check"? It gets invoked for BPF_WRITE, so should be rejecting
>> res->key = 42 if 'res' is a pointer with PTR_UNTRUSTED flag set. What am I
>> missing?
>
> The direct write will pass this earlier permission check since
> type_is_ptr_alloc_obj does not check PTR_UNTRUSTED:
> if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type))
> return -EACCES;
>
> The later PTR_UNTRUSTED branch is not a rejection check. It means when
> accessing a pointer field through an untrusted parent pointer,
> propagate PTR_UNTRUSTED to the child pointer.
>
> if (ret != PTR_TO_BTF_ID) {
> /* just mark; */
>
> } else if (type_flag(reg->type) & PTR_UNTRUSTED) {
> /* If this is an untrusted pointer, all pointers formed by walking it
> * also inherit the untrusted flag.
> */
> flag = PTR_UNTRUSTED;
>
> }
>
> For res->key = 42, key is a scalar, so ret != PTR_TO_BTF_ID. Therefore
> the second branch is skipped and has no effect.
I am talking about this bit before all of that logic:
if (atype != BPF_READ && (type_flag(reg->type) & PTR_UNTRUSTED)) {
verbose(env, "only read is supported\n");
return -EACCES;
}
Why is this not enough? 'key' is scalar, but 'res' which is being written to is
still a PTR_TO_BTF_ID with PTR_UNTRUSTED.
