mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-27 12:57:53 +00:00
Code Issues Releases Wiki Activity

bpf-for-netdev

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTFp0I1jqZrAX+hPRXbK58LschIgwUCZkGSLAAKCRDbK58LschI
 gzFIAQDX9yJYEj3ppVR3oPf9Czqj4oVPE2ZNAmVlTig3eZikfAD9Gh0s5iERnFfs
 WAST1OgUF/4EHktO/7PKtkvBg0DdQgk=
 =DviD
 -----END PGP SIGNATURE-----

Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says:

====================
pull-request: bpf 2024-05-13

We've added 3 non-merge commits during the last 2 day(s) which contain
a total of 2 files changed, 62 insertions(+), 8 deletions(-).

The main changes are:

1) Fix a case where syzkaller found that it's unexpectedly possible
   to attach a cgroup_skb program to the sockopt hooks. The fix adds
   missing attach_type enforcement for the link_create case along
   with selftests, from Stanislav Fomichev.

* tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: Add sockopt case to verify prog_type
  selftests/bpf: Extend sockopt tests to use BPF_LINK_CREATE
  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
====================

Link: https://lore.kernel.org/r/20240513041845.31040-1-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2024-05-13 13:10:48 -07:00
commit c9f9df3f63
2 changed files with 62 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
kernel/bpf/syscall.c
View file

@ -3985,6 +3985,11 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
* check permissions at attach time.
*/
return -EPERM;
ptype = attach_type_to_prog_type(attach_type);
if (prog->type != ptype)
return -EINVAL;
return prog->enforce_expected_attach_type &&
prog->expected_attach_type != attach_type ?
-EINVAL : 0;

65
tools/testing/selftests/bpf/prog_tests/sockopt.c
View file

@ -24,6 +24,7 @@ enum sockopt_test_error {
static struct sockopt_test {
const char *descr;
const struct bpf_insn insns[64];
enum bpf_prog_type prog_type;
enum bpf_attach_type attach_type;
enum bpf_attach_type expected_attach_type;
@ -928,9 +929,40 @@ static struct sockopt_test {
.error = EPERM_SETSOCKOPT,
},
/* ==================== prog_type ==================== */
{
.descr = "can attach only BPF_CGROUP_SETSOCKOP",
.insns = {
/* return 1 */
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
.attach_type = BPF_CGROUP_SETSOCKOPT,
.expected_attach_type = 0,
.error = DENY_ATTACH,
},
{
.descr = "can attach only BPF_CGROUP_GETSOCKOP",
.insns = {
/* return 1 */
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
.attach_type = BPF_CGROUP_GETSOCKOPT,
.expected_attach_type = 0,
.error = DENY_ATTACH,
},
};
static int load_prog(const struct bpf_insn *insns,
enum bpf_prog_type prog_type,
enum bpf_attach_type expected_attach_type)
{
LIBBPF_OPTS(bpf_prog_load_opts, opts,
@ -947,7 +979,7 @@ static int load_prog(const struct bpf_insn *insns,
}
insns_cnt++;
fd = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCKOPT, NULL, "GPL", insns, insns_cnt, &opts);
fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);
if (verbose && fd < 0)
fprintf(stderr, "%s\n", bpf_log_buf);
@ -1036,13 +1068,18 @@ static int call_getsockopt(bool use_io_uring, int fd, int level, int optname,
return getsockopt(fd, level, optname, optval, optlen);
}
static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring)
static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring,
bool use_link)
{
int sock_fd, err, prog_fd;
int prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT;
int sock_fd, err, prog_fd, link_fd = -1;
void *optval = NULL;
int ret = 0;
prog_fd = load_prog(test->insns, test->expected_attach_type);
if (test->prog_type)
prog_type = test->prog_type;
prog_fd = load_prog(test->insns, prog_type, test->expected_attach_type);
if (prog_fd < 0) {
if (test->error == DENY_LOAD)
return 0;
@ -1051,7 +1088,12 @@ static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring)
return -1;
}
err = bpf_prog_attach(prog_fd, cgroup_fd, test->attach_type, 0);
if (use_link) {
err = bpf_link_create(prog_fd, cgroup_fd, test->attach_type, NULL);
link_fd = err;
} else {
err = bpf_prog_attach(prog_fd, cgroup_fd, test->attach_type, 0);
}
if (err < 0) {
if (test->error == DENY_ATTACH)
goto close_prog_fd;
@ -1142,7 +1184,12 @@ static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring)
close_sock_fd:
close(sock_fd);
detach_prog:
bpf_prog_detach2(prog_fd, cgroup_fd, test->attach_type);
if (use_link) {
if (link_fd >= 0)
close(link_fd);
} else {
bpf_prog_detach2(prog_fd, cgroup_fd, test->attach_type);
}
close_prog_fd:
close(prog_fd);
return ret;
@ -1160,10 +1207,12 @@ void test_sockopt(void)
if (!test__start_subtest(tests[i].descr))
continue;
ASSERT_OK(run_test(cgroup_fd, &tests[i], false),
ASSERT_OK(run_test(cgroup_fd, &tests[i], false, false),
tests[i].descr);
ASSERT_OK(run_test(cgroup_fd, &tests[i], false, true),
tests[i].descr);
if (tests[i].io_uring_support)
ASSERT_OK(run_test(cgroup_fd, &tests[i], true),
ASSERT_OK(run_test(cgroup_fd, &tests[i], true, false),
tests[i].descr);
}