mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 14:44:12 +00:00
7cdd210890
When the kfunc hid_bpf_attach_prog() is called, we called twice fdget():
one for fetching the type of the bpf program, and one for actually
attaching the program to the device.
The problem is that between those two calls, we have no guarantees that
the prog_fd is still the same file descriptor for the given program.
Solve this by calling bpf_prog_get() earlier, and use this to fetch the
program type.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/bpf/CAO-hwJJ8vh8JD3-P43L-_CLNmPx0hWj44aom0O838vfP4=_1CA@mail.gmail.com/T/#t
Cc: <stable@vger.kernel.org>
Fixes: f5c27da4e3 ("HID: initial BPF implementation")
Link: https://lore.kernel.org/r/20240124-b4-hid-bpf-fixes-v2-1-052520b1e5e6@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
25 lines
717 B
C
25 lines
717 B
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
|
|
#ifndef _BPF_HID_BPF_DISPATCH_H
|
|
#define _BPF_HID_BPF_DISPATCH_H
|
|
|
|
#include <linux/hid.h>
|
|
|
|
struct hid_bpf_ctx_kern {
|
|
struct hid_bpf_ctx ctx;
|
|
u8 *data;
|
|
};
|
|
|
|
int hid_bpf_preload_skel(void);
|
|
void hid_bpf_free_links_and_skel(void);
|
|
int hid_bpf_get_prog_attach_type(struct bpf_prog *prog);
|
|
int __hid_bpf_attach_prog(struct hid_device *hdev, enum hid_bpf_prog_type prog_type, int prog_fd,
|
|
struct bpf_prog *prog, __u32 flags);
|
|
void __hid_bpf_destroy_device(struct hid_device *hdev);
|
|
int hid_bpf_prog_run(struct hid_device *hdev, enum hid_bpf_prog_type type,
|
|
struct hid_bpf_ctx_kern *ctx_kern);
|
|
int hid_bpf_reconnect(struct hid_device *hdev);
|
|
|
|
struct bpf_prog;
|
|
|
|
#endif
|