Re: [PATCH bpf 0/2] bpf: Gate dynptr probe-read kfuncs like helpers

[Chris Down]

Hey Alexei,

Alexei Starovoitov writes:
> It's fine as-is. Won't fix.

Could you expand a bit on the lockdown side of this? I ran into the same 
discrepancy independently and was preparing fixes until I found this thread 
while looking for prior discussion.

The CAP_PERFMON side is now covered by 81c975aae375 ("bpf: Require CAP_PERFMON 
for kfuncs reading memory"), but the probe_read_kernel helpers still check 
LOCKDOWN_BPF_READ_KERNEL while the matching dynptr kfuncs don't. Is that 
intentional?

I also checked bpf_rdonly_cast() plus typed loads, which can still read kernel 
memory in that mode, so I can see why just gating the two dynptr kfuncs 
wouldn't give us a consistent boundary. I'm less clear on whether that's the 
reason for leaving them alone or there's some other reason.

Thanks,

Chris