linux-stable/kernel/bpf
Toke Høiland-Jørgensen 6782f3b9ab bpf: Resolve fext program type when checking map compatibility
[ Upstream commit 1c123c567f ]

The bpf_prog_map_compatible() check makes sure that BPF program types are
not mixed inside BPF map types that can contain programs (tail call maps,
cpumaps and devmaps). It does this by setting the fields of the map->owner
struct to the values of the first program being checked against, and
rejecting any subsequent programs if the values don't match.

One of the values being set in the map owner struct is the program type,
and since the code did not resolve the prog type for fext programs, the map
owner type would be set to PROG_TYPE_EXT and subsequent loading of programs
of the target type into the map would fail.

This bug is seen in particular for XDP programs that are loaded as
PROG_TYPE_EXT using libxdp; these cannot insert programs into devmaps and
cpumaps because the check fails as described above.

Fix the bug by resolving the fext program type to its target program type
as elsewhere in the verifier.

v3:
- Add Yonghong's ACK

Fixes: f45d5b6ce2 ("bpf: generalise tail call map compatibility check")
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://lore.kernel.org/r/20221214230254.790066-1-toke@redhat.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-07 11:15:47 +01:00
..
preload bpf: iterators: Build and use lightweight bootstrap version of bpftool 2022-07-15 12:01:30 -07:00
Kconfig rcu: Make the TASKS_RCU Kconfig option be selected 2022-04-20 16:52:58 -07:00
Makefile bpf: Add bpf_link iterator 2022-05-10 11:20:45 -07:00
arraymap.c bpf: Acquire map uref in .init_seq_private for array map iterator 2022-08-10 10:12:47 -07:00
bloom_filter.c bpf: Compute map_btf_id during build time 2022-04-26 11:35:21 -07:00
bpf_inode_storage.c bpf: Compute map_btf_id during build time 2022-04-26 11:35:21 -07:00
bpf_iter.c bpf: Only allow sleepable program for resched-able iterator 2022-08-10 10:12:48 -07:00
bpf_local_storage.c bpf: Do not copy spin lock field from user in bpf_selem_alloc 2022-12-08 11:30:15 +01:00
bpf_lru_list.c
bpf_lru_list.h printk: stop including cache.h from printk.h 2022-05-13 07:20:07 -07:00
bpf_lsm.c bpf: Only add BTF IDs for socket security hooks when CONFIG_SECURITY_NETWORK is on 2022-10-21 12:38:06 +02:00
bpf_struct_ops.c bpf: Remove is_valid_bpf_tramp_flags() 2022-07-11 21:04:58 +02:00
bpf_struct_ops_types.h bpf: Add dummy BPF STRUCT_OPS for test purpose 2021-11-01 14:10:00 -07:00
bpf_task_storage.c bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy 2022-10-21 12:38:05 +02:00
btf.c bpf: Prevent decl_tag from being referenced in func_proto arg 2022-12-31 13:26:45 +01:00
cgroup.c bpf, cgroup: Reject prog_attach_flags array when effective query 2022-10-21 12:38:11 +02:00
core.c bpf: Resolve fext program type when checking map compatibility 2023-01-07 11:15:47 +01:00
cpumap.c bpf: Compute map_btf_id during build time 2022-04-26 11:35:21 -07:00
devmap.c bpf, devmap: Compute proper xdp_frame len redirecting frames 2022-07-26 16:26:19 +02:00
disasm.c
disasm.h
dispatcher.c bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE() 2022-12-02 17:43:18 +01:00
hashtab.c bpf: Propagate error from htab_lock_bucket() to userspace 2022-10-21 12:38:05 +02:00
helpers.c btf: Export bpf_dynptr definition 2022-10-21 12:37:37 +02:00
inode.c bpf: Convert bpf_preload.ko to use light skeleton. 2022-02-10 23:31:51 +01:00
link_iter.c bpf: Add bpf_link iterator 2022-05-10 11:20:45 -07:00
local_storage.c bpf: Make non-preallocated allocation low priority 2022-07-12 17:44:27 -07:00
lpm_trie.c bpf: Make non-preallocated allocation low priority 2022-07-12 17:44:27 -07:00
map_in_map.c bpf: Allow storing unreferenced kptr in map 2022-04-25 17:31:35 -07:00
map_in_map.h
map_iter.c bpf: Introduce MEM_RDONLY flag 2021-12-18 13:27:41 -08:00
mmap_unlock_work.h bpf: Introduce helper bpf_find_vma 2021-11-07 11:54:51 -08:00
net_namespace.c net: Add includes masked by netdevice.h including uapi/bpf.h 2021-12-29 20:03:05 -08:00
offload.c
percpu_freelist.c bpf: Initialize same number of free nodes for each pcpu_freelist 2022-11-26 09:27:33 +01:00
percpu_freelist.h
prog_iter.c
queue_stack_maps.c bpf: Compute map_btf_id during build time 2022-04-26 11:35:21 -07:00
reuseport_array.c net: Fix suspicious RCU usage in bpf_sk_reuseport_detach() 2022-08-17 16:42:59 -07:00
ringbuf.c bpf: Dynptr support for ring buffers 2022-05-23 14:31:28 -07:00
stackmap.c bpf: Compute map_btf_id during build time 2022-04-26 11:35:21 -07:00
syscall.c bpf: prevent leak of lsm program after failed attach 2022-12-31 13:26:37 +01:00
sysfs_btf.c
task_iter.c bpf: Remove redundant assignment to meta.seq in __task_seq_show() 2022-04-11 21:14:34 +02:00
tnum.c
trampoline.c bpf: Prevent bpf program recursion for raw tracepoint probes 2022-11-26 09:27:56 +01:00
verifier.c bpf: Do not zero-extend kfunc return values 2022-12-31 13:26:12 +01:00