github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-27 08:33:17 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Merge branch 'bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE'

Browse Source 
Stanislav Fomichev says:

====================
Syzkaller found a case where it's possible to attach cgroup_skb program
to the sockopt hooks. Apparently it's currently possible to do that,
but only when using BPF_LINK_CREATE API. The first patch in the series
has more info on why that happens.
====================

Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
This commit is contained in:
Martin KaFai Lau 2024-04-30 10:43:38 -07:00
commit 3e9bc0472b
2 changed files with 62 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
kernel/bpf/syscall.c
View File

@ -3985,6 +3985,11 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
* check permissions at attach time.
*/
return -EPERM;
ptype = attach_type_to_prog_type(attach_type);
if (prog->type != ptype)
return -EINVAL;
return prog->enforce_expected_attach_type &&
prog->expected_attach_type != attach_type ?
-EINVAL : 0;

65
tools/testing/selftests/bpf/prog_tests/sockopt.c
View File

@ -24,6 +24,7 @@ enum sockopt_test_error {
static struct sockopt_test {
const char *descr;
const struct bpf_insn insns[64];
enum bpf_prog_type prog_type;
enum bpf_attach_type attach_type;
enum bpf_attach_type expected_attach_type;
@ -928,9 +929,40 @@ static struct sockopt_test {
.error = EPERM_SETSOCKOPT,
},
/* ==================== prog_type ==================== */
{
.descr = "can attach only BPF_CGROUP_SETSOCKOP",
.insns = {
/* return 1 */
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
.attach_type = BPF_CGROUP_SETSOCKOPT,
.expected_attach_type = 0,
.error = DENY_ATTACH,
},
{
.descr = "can attach only BPF_CGROUP_GETSOCKOP",
.insns = {
/* return 1 */
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
.attach_type = BPF_CGROUP_GETSOCKOPT,
.expected_attach_type = 0,
.error = DENY_ATTACH,
},
};
static int load_prog(const struct bpf_insn *insns,
enum bpf_prog_type prog_type,
enum bpf_attach_type expected_attach_type)
{
LIBBPF_OPTS(bpf_prog_load_opts, opts,
@ -947,7 +979,7 @@ static int load_prog(const struct bpf_insn *insns,
}
insns_cnt++;
fd = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCKOPT, NULL, "GPL", insns, insns_cnt, &opts);
fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);
if (verbose && fd < 0)
fprintf(stderr, "%s\n", bpf_log_buf);
@ -1036,13 +1068,18 @@ static int call_getsockopt(bool use_io_uring, int fd, int level, int optname,
return getsockopt(fd, level, optname, optval, optlen);
}
static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring)
static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring,
bool use_link)
{
int sock_fd, err, prog_fd;
int prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT;
int sock_fd, err, prog_fd, link_fd = -1;
void *optval = NULL;
int ret = 0;
prog_fd = load_prog(test->insns, test->expected_attach_type);
if (test->prog_type)
prog_type = test->prog_type;
prog_fd = load_prog(test->insns, prog_type, test->expected_attach_type);
if (prog_fd < 0) {
if (test->error == DENY_LOAD)
return 0;
@ -1051,7 +1088,12 @@ static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring)
return -1;
}
err = bpf_prog_attach(prog_fd, cgroup_fd, test->attach_type, 0);
if (use_link) {
err = bpf_link_create(prog_fd, cgroup_fd, test->attach_type, NULL);
link_fd = err;
} else {
err = bpf_prog_attach(prog_fd, cgroup_fd, test->attach_type, 0);
}
if (err < 0) {
if (test->error == DENY_ATTACH)
goto close_prog_fd;
@ -1142,7 +1184,12 @@ static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring)
close_sock_fd:
close(sock_fd);
detach_prog:
bpf_prog_detach2(prog_fd, cgroup_fd, test->attach_type);
if (use_link) {
if (link_fd >= 0)
close(link_fd);
} else {
bpf_prog_detach2(prog_fd, cgroup_fd, test->attach_type);
}
close_prog_fd:
close(prog_fd);
return ret;
@ -1160,10 +1207,12 @@ void test_sockopt(void)
if (!test__start_subtest(tests[i].descr))
continue;
ASSERT_OK(run_test(cgroup_fd, &tests[i], false),
ASSERT_OK(run_test(cgroup_fd, &tests[i], false, false),
tests[i].descr);
ASSERT_OK(run_test(cgroup_fd, &tests[i], false, true),
tests[i].descr);
if (tests[i].io_uring_support)
ASSERT_OK(run_test(cgroup_fd, &tests[i], true),
ASSERT_OK(run_test(cgroup_fd, &tests[i], true, false),
tests[i].descr);
}