Commit a766cfbb authored by Song Liu's avatar Song Liu Committed by Alexei Starovoitov
Browse files

bpf: Mark dentry->d_inode as trusted_or_null 



LSM hooks such as security_path_mknod() and security_inode_rename() have
access to newly allocated negative dentry, which has NULL d_inode.
Therefore, it is necessary to do the NULL pointer check for d_inode.

Also add selftests that checks the verifier enforces the NULL pointer
check.

Signed-off-by: default avatarSong Liu <song@kernel.org>
Reviewed-by: default avatarMatt Bobrowski <mattbobrowski@google.com>
Link: https://lore.kernel.org/r/20250613052857.1992233-1-song@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 9afe6529

kernel/bpf/verifier.c

+2 −3
Original line number Diff line number Diff line
@@ -7027,8 +7027,7 @@ BTF_TYPE_SAFE_TRUSTED(struct file) { 
	struct inode *f_inode;

};









BTF_TYPE_SAFE_TRUSTED(struct dentry) {









	/* no negative dentry-s in places where bpf can see it */









BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct dentry) {









	struct inode *d_inode;









};
















@@ -7066,7 +7065,6 @@ static bool type_is_trusted(struct bpf_verifier_env *env,







	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct bpf_iter__task));









	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct linux_binprm));









	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct file));









	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED(struct dentry));

















	return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id, "__safe_trusted");









}








@@ -7076,6 +7074,7 @@ static bool type_is_trusted_or_null(struct bpf_verifier_env *env,







				    const char *field_name, u32 btf_id)









{









	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct socket));









	BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct dentry));

















	return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id,









					  "__safe_trusted_or_null");
































tools/testing/selftests/bpf/progs/verifier_vfs_accept.c



+18
−0






























Original line number
Diff line number
Diff line







@@ -2,6 +2,7 @@







/* Copyright (c) 2024 Google LLC. */



















#include <vmlinux.h>









#include <errno.h>









#include <bpf/bpf_helpers.h>









#include <bpf/bpf_tracing.h>


















@@ -82,4 +83,21 @@ int BPF_PROG(path_d_path_from_file_argument, struct file *file)







	return 0;









}



















SEC("lsm.s/inode_rename")









__success









int BPF_PROG(inode_rename, struct inode *old_dir, struct dentry *old_dentry,









	     struct inode *new_dir, struct dentry *new_dentry,









	     unsigned int flags)









{









	struct inode *inode = new_dentry->d_inode;









	ino_t ino;



















	if (!inode)









		return 0;









	ino = inode->i_ino;









	if (ino == 0)









		return -EACCES;









	return 0;









}



















char _license[] SEC("license") = "GPL";
























tools/testing/selftests/bpf/progs/verifier_vfs_reject.c



+15
−0






























Original line number
Diff line number
Diff line







@@ -2,6 +2,7 @@







/* Copyright (c) 2024 Google LLC. */



















#include <vmlinux.h>









#include <errno.h>









#include <bpf/bpf_helpers.h>









#include <bpf/bpf_tracing.h>









#include <linux/limits.h>








@@ -158,4 +159,18 @@ int BPF_PROG(path_d_path_kfunc_non_lsm, struct path *path, struct file *f)







	return 0;









}



















SEC("lsm.s/inode_rename")









__failure __msg("invalid mem access 'trusted_ptr_or_null_'")









int BPF_PROG(inode_rename, struct inode *old_dir, struct dentry *old_dentry,









	     struct inode *new_dir, struct dentry *new_dentry,









	     unsigned int flags)









{









	struct inode *inode = new_dentry->d_inode;









	ino_t ino;



















	ino = inode->i_ino;









	if (ino == 0)









		return -EACCES;









	return 0;









}









char _license[] SEC("license") = "GPL";