bpf: satisfy the verifier on v5.3 generic programs

Verifier complains with clang-18 compiling bpf_generic_kprobe_v53.o and loading it on 5.4.278. Signed-off-by: Mahe Tardy <[email protected]>
cilium · Aug 16, 2024 · 0ed915a · 0ed915a
1 parent 57314f7
commit 0ed915a
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/bpf/process/pfilter.h b/bpf/process/pfilter.h
@@ -281,6 +281,13 @@ process_filter_capability_change(__u32 ty, __u32 op, __u32 ns, __u64 val,
 		return PFILTER_REJECT;
 
 	icaps = init->caps.c[ty];
+
+	// When compiling bpf_generic_kprobe_v53.o with clang-18 and loading it on
+	// 5.4.278, the verifier complains than ty could be negative while in this
+	// context it's just the capability set type (effective, inheritable, or
+	// permitted), let's blindly remind the verifier it's a u32.
+	asm volatile("%[ty] &= 0xffffffff;\n"
+		     : [ty] "+r"(ty));
 	ccaps = c->c[ty];
 
 	/* we have a change in the capabilities that we care */