1 files changed, 8 insertions, 0 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6a86723c5b64..4016774d5cca 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1276,6 +1276,14 @@ static int check_map_func_compatibility(struct bpf_map *map, int func_id)
                     func_id != BPF_FUNC_current_task_under_cgroup)
                         goto error;
                 break;
+        /* devmap returns a pointer to a live net_device ifindex that we cannot
+         * allow to be modified from bpf side. So do not allow lookup elements
+         * for now.
+         */
+        case BPF_MAP_TYPE_DEVMAP:
+                if (func_id == BPF_FUNC_map_lookup_elem)
+                        goto error;
+                break;
         case BPF_MAP_TYPE_ARRAY_OF_MAPS:
         case BPF_MAP_TYPE_HASH_OF_MAPS:
                 if (func_id != BPF_FUNC_map_lookup_elem)