Commit 1728df7f authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 

Daniel Borkmann says:

====================
pull-request: bpf-next 2023-12-19

Hi David, hi Jakub, hi Paolo, hi Eric,

The following pull-request contains BPF updates for your *net-next* tree.

We've added 2 non-merge commits during the last 1 day(s) which contain
a total of 40 files changed, 642 insertions(+), 2926 deletions(-).

The main changes are:

1) Revert all of BPF token-related patches for now as per list discussion [0],
   from Andrii Nakryiko.

   [0] https://lore.kernel.org/bpf/CAHk-=wg7JuFYwGy=GOMbRCtOL+jwSQsdUaBsRWkDVYbxipbM5A@mail.gmail.com

2) Fix a syzbot-reported use-after-free read in nla_find() triggered from
   bpf_skb_get_nlattr_nest() helper, from Jakub Kicinski.

bpf-next-for-netdev

* tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next:
  Revert BPF token-related functionality
  bpf: Use nla_ok() instead of checking nla_len directly
====================

Link: https://lore.kernel.org/r/20231219170359.11035-1-daniel@iogearbox.net


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 62ed78f3 d17aff80

drivers/media/rc/bpf-lirc.c

+1 −1
Original line number Diff line number Diff line
@@ -110,7 +110,7 @@ lirc_mode2_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
	case BPF_FUNC_get_prandom_u32:

		return &bpf_get_prandom_u32_proto;

	case BPF_FUNC_trace_printk:

		if (bpf_token_capable(prog->aux->token, CAP_PERFMON))

		if (perfmon_capable())

			return bpf_get_trace_printk_proto();

		fallthrough;

	default:

include/linux/bpf.h

+10 −75
Original line number Diff line number Diff line
@@ -52,10 +52,6 @@ struct module; 
struct bpf_func_state;

struct ftrace_ops;

struct cgroup;

struct bpf_token;

struct user_namespace;

struct super_block;

struct inode;



extern struct idr btf_idr;

extern spinlock_t btf_idr_lock;
@@ -1488,7 +1484,6 @@ struct bpf_prog_aux { 
#ifdef CONFIG_SECURITY

	void *security;

#endif

	struct bpf_token *token;

	struct bpf_prog_offload *offload;

	struct btf *btf;

	struct bpf_func_info *func_info;
@@ -1613,31 +1608,6 @@ struct bpf_link_primer { 
	u32 id;

};



struct bpf_mount_opts {

	kuid_t uid;

	kgid_t gid;

	umode_t mode;



	/* BPF token-related delegation options */

	u64 delegate_cmds;

	u64 delegate_maps;

	u64 delegate_progs;

	u64 delegate_attachs;

};



struct bpf_token {

	struct work_struct work;

	atomic64_t refcnt;

	struct user_namespace *userns;

	u64 allowed_cmds;

	u64 allowed_maps;

	u64 allowed_progs;

	u64 allowed_attachs;

#ifdef CONFIG_SECURITY

	void *security;

#endif

};



struct bpf_struct_ops_value;

struct btf_member;
@@ -2097,7 +2067,6 @@ static inline void bpf_enable_instrumentation(void) 
	migrate_enable();

}



extern const struct super_operations bpf_super_ops;

extern const struct file_operations bpf_map_fops;

extern const struct file_operations bpf_prog_fops;

extern const struct file_operations bpf_iter_fops;
@@ -2232,26 +2201,24 @@ static inline void bpf_map_dec_elem_count(struct bpf_map *map) 


extern int sysctl_unprivileged_bpf_disabled;



bool bpf_token_capable(const struct bpf_token *token, int cap);



static inline bool bpf_allow_ptr_leaks(const struct bpf_token *token)

static inline bool bpf_allow_ptr_leaks(void)

{

	return bpf_token_capable(token, CAP_PERFMON);

	return perfmon_capable();

}



static inline bool bpf_allow_uninit_stack(const struct bpf_token *token)

static inline bool bpf_allow_uninit_stack(void)

{

	return bpf_token_capable(token, CAP_PERFMON);

	return perfmon_capable();

}



static inline bool bpf_bypass_spec_v1(const struct bpf_token *token)

static inline bool bpf_bypass_spec_v1(void)

{

	return cpu_mitigations_off() || bpf_token_capable(token, CAP_PERFMON);

	return cpu_mitigations_off() || perfmon_capable();

}



static inline bool bpf_bypass_spec_v4(const struct bpf_token *token)

static inline bool bpf_bypass_spec_v4(void)

{

	return cpu_mitigations_off() || bpf_token_capable(token, CAP_PERFMON);

	return cpu_mitigations_off() || perfmon_capable();

}



int bpf_map_new_fd(struct bpf_map *map, int flags);
@@ -2268,21 +2235,8 @@ int bpf_link_new_fd(struct bpf_link *link); 
struct bpf_link *bpf_link_get_from_fd(u32 ufd);

struct bpf_link *bpf_link_get_curr_or_next(u32 *id);



void bpf_token_inc(struct bpf_token *token);

void bpf_token_put(struct bpf_token *token);

int bpf_token_create(union bpf_attr *attr);

struct bpf_token *bpf_token_get_from_fd(u32 ufd);



bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd);

bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type);

bool bpf_token_allow_prog_type(const struct bpf_token *token,

			       enum bpf_prog_type prog_type,

			       enum bpf_attach_type attach_type);



int bpf_obj_pin_user(u32 ufd, int path_fd, const char __user *pathname);

int bpf_obj_get_user(int path_fd, const char __user *pathname, int flags);

struct inode *bpf_get_inode(struct super_block *sb, const struct inode *dir,

			    umode_t mode);



#define BPF_ITER_FUNC_PREFIX "bpf_iter_"

#define DEFINE_BPF_ITER_FUNC(target, args...)			\
@@ -2526,8 +2480,7 @@ const char *btf_find_decl_tag_value(const struct btf *btf, const struct btf_type 
struct bpf_prog *bpf_prog_by_id(u32 id);

struct bpf_link *bpf_link_by_id(u32 id);



const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id,

						 const struct bpf_prog *prog);

const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id);

void bpf_task_storage_free(struct task_struct *task);

void bpf_cgrp_storage_free(struct cgroup *cgroup);

bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog);
@@ -2646,24 +2599,6 @@ static inline int bpf_obj_get_user(const char __user *pathname, int flags) 
	return -EOPNOTSUPP;

}



static inline bool bpf_token_capable(const struct bpf_token *token, int cap)

{

	return capable(cap) || (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN));

}



static inline void bpf_token_inc(struct bpf_token *token)

{

}



static inline void bpf_token_put(struct bpf_token *token)

{

}



static inline struct bpf_token *bpf_token_get_from_fd(u32 ufd)

{

	return ERR_PTR(-EOPNOTSUPP);

}



static inline void __dev_flush(void)

{

}
@@ -2787,7 +2722,7 @@ static inline int btf_struct_access(struct bpf_verifier_log *log, 
}



static inline const struct bpf_func_proto *

bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)

bpf_base_func_proto(enum bpf_func_id func_id)

{

	return NULL;

}

include/linux/filter.h

+1 −1
Original line number Diff line number Diff line
@@ -1139,7 +1139,7 @@ static inline bool bpf_jit_blinding_enabled(struct bpf_prog *prog) 
		return false;

	if (!bpf_jit_harden)

		return false;

	if (bpf_jit_harden == 1 && bpf_token_capable(prog->aux->token, CAP_BPF))

	if (bpf_jit_harden == 1 && bpf_capable())

		return false;



	return true;

include/linux/lsm_hook_defs.h

+4 −11
Original line number Diff line number Diff line
@@ -398,17 +398,10 @@ LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule) 
LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size)

LSM_HOOK(int, 0, bpf_map, struct bpf_map *map, fmode_t fmode)

LSM_HOOK(int, 0, bpf_prog, struct bpf_prog *prog)

LSM_HOOK(int, 0, bpf_map_create, struct bpf_map *map, union bpf_attr *attr,

	 struct bpf_token *token)

LSM_HOOK(void, LSM_RET_VOID, bpf_map_free, struct bpf_map *map)

LSM_HOOK(int, 0, bpf_prog_load, struct bpf_prog *prog, union bpf_attr *attr,

	 struct bpf_token *token)

LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free, struct bpf_prog *prog)

LSM_HOOK(int, 0, bpf_token_create, struct bpf_token *token, union bpf_attr *attr,

	 struct path *path)

LSM_HOOK(void, LSM_RET_VOID, bpf_token_free, struct bpf_token *token)

LSM_HOOK(int, 0, bpf_token_cmd, const struct bpf_token *token, enum bpf_cmd cmd)

LSM_HOOK(int, 0, bpf_token_capable, const struct bpf_token *token, int cap)

LSM_HOOK(int, 0, bpf_map_alloc_security, struct bpf_map *map)

LSM_HOOK(void, LSM_RET_VOID, bpf_map_free_security, struct bpf_map *map)

LSM_HOOK(int, 0, bpf_prog_alloc_security, struct bpf_prog_aux *aux)

LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux)

#endif /* CONFIG_BPF_SYSCALL */



LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)

include/linux/security.h

+7 −36
Original line number Diff line number Diff line
@@ -32,7 +32,6 @@ 
#include <linux/string.h>

#include <linux/mm.h>

#include <linux/sockptr.h>

#include <linux/bpf.h>



struct linux_binprm;

struct cred;
@@ -2021,22 +2020,15 @@ static inline void securityfs_remove(struct dentry *dentry) 
union bpf_attr;

struct bpf_map;

struct bpf_prog;

struct bpf_token;

struct bpf_prog_aux;

#ifdef CONFIG_SECURITY

extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);

extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);

extern int security_bpf_prog(struct bpf_prog *prog);

extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,

				   struct bpf_token *token);

extern int security_bpf_map_alloc(struct bpf_map *map);

extern void security_bpf_map_free(struct bpf_map *map);

extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,

				  struct bpf_token *token);

extern void security_bpf_prog_free(struct bpf_prog *prog);

extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,

				     struct path *path);

extern void security_bpf_token_free(struct bpf_token *token);

extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd);

extern int security_bpf_token_capable(const struct bpf_token *token, int cap);

extern int security_bpf_prog_alloc(struct bpf_prog_aux *aux);

extern void security_bpf_prog_free(struct bpf_prog_aux *aux);

#else

static inline int security_bpf(int cmd, union bpf_attr *attr,

					     unsigned int size)
@@ -2054,8 +2046,7 @@ static inline int security_bpf_prog(struct bpf_prog *prog) 
	return 0;

}



static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,

					  struct bpf_token *token)

static inline int security_bpf_map_alloc(struct bpf_map *map)

{

	return 0;

}
@@ -2063,33 +2054,13 @@ static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *a 
static inline void security_bpf_map_free(struct bpf_map *map)

{ }



static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,

					 struct bpf_token *token)

static inline int security_bpf_prog_alloc(struct bpf_prog_aux *aux)

{

	return 0;

}



static inline void security_bpf_prog_free(struct bpf_prog *prog)

static inline void security_bpf_prog_free(struct bpf_prog_aux *aux)

{ }



static inline int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,

				     struct path *path)

{

	return 0;

}



static inline void security_bpf_token_free(struct bpf_token *token)

{ }



static inline int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)

{

	return 0;

}



static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)

{

	return 0;

}

#endif /* CONFIG_SECURITY */

#endif /* CONFIG_BPF_SYSCALL */