Commit 3e9bc047 authored by Martin KaFai Lau's avatar Martin KaFai Lau
Browse files

Merge branch 'bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE' 



Stanislav Fomichev says:

====================
Syzkaller found a case where it's possible to attach cgroup_skb program
to the sockopt hooks. Apparently it's currently possible to do that,
but only when using BPF_LINK_CREATE API. The first patch in the series
has more info on why that happens.
====================

Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parents b8672475 095ddb50

kernel/bpf/syscall.c

+5 −0
Original line number Diff line number Diff line
@@ -3985,6 +3985,11 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog, 
			 * check permissions at attach time.

			 */

			return -EPERM;



		ptype = attach_type_to_prog_type(attach_type);

		if (prog->type != ptype)

			return -EINVAL;



		return prog->enforce_expected_attach_type &&

			prog->expected_attach_type != attach_type ?

			-EINVAL : 0;

tools/testing/selftests/bpf/prog_tests/sockopt.c

+57 −8
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ enum sockopt_test_error { 
static struct sockopt_test {

	const char			*descr;

	const struct bpf_insn		insns[64];

	enum bpf_prog_type		prog_type;

	enum bpf_attach_type		attach_type;

	enum bpf_attach_type		expected_attach_type;
@@ -928,9 +929,40 @@ static struct sockopt_test { 


		.error = EPERM_SETSOCKOPT,

	},



	/* ==================== prog_type ====================  */



	{

		.descr = "can attach only BPF_CGROUP_SETSOCKOP",

		.insns = {

			/* return 1 */

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),



		},

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

		.attach_type = BPF_CGROUP_SETSOCKOPT,

		.expected_attach_type = 0,

		.error = DENY_ATTACH,

	},



	{

		.descr = "can attach only BPF_CGROUP_GETSOCKOP",

		.insns = {

			/* return 1 */

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),



		},

		.prog_type = BPF_PROG_TYPE_CGROUP_SKB,

		.attach_type = BPF_CGROUP_GETSOCKOPT,

		.expected_attach_type = 0,

		.error = DENY_ATTACH,

	},

};



static int load_prog(const struct bpf_insn *insns,

		     enum bpf_prog_type prog_type,

		     enum bpf_attach_type expected_attach_type)

{

	LIBBPF_OPTS(bpf_prog_load_opts, opts,
@@ -947,7 +979,7 @@ static int load_prog(const struct bpf_insn *insns, 
	}

	insns_cnt++;



	fd = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCKOPT, NULL, "GPL", insns, insns_cnt, &opts);

	fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);

	if (verbose && fd < 0)

		fprintf(stderr, "%s\n", bpf_log_buf);
@@ -1036,13 +1068,18 @@ static int call_getsockopt(bool use_io_uring, int fd, int level, int optname, 
	return getsockopt(fd, level, optname, optval, optlen);

}



static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring)

static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring,

		    bool use_link)

{

	int sock_fd, err, prog_fd;

	int prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT;

	int sock_fd, err, prog_fd, link_fd = -1;

	void *optval = NULL;

	int ret = 0;



	prog_fd = load_prog(test->insns, test->expected_attach_type);

	if (test->prog_type)

		prog_type = test->prog_type;



	prog_fd = load_prog(test->insns, prog_type, test->expected_attach_type);

	if (prog_fd < 0) {

		if (test->error == DENY_LOAD)

			return 0;
@@ -1051,7 +1088,12 @@ static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring) 
		return -1;

	}



	if (use_link) {

		err = bpf_link_create(prog_fd, cgroup_fd, test->attach_type, NULL);

		link_fd = err;

	} else {

		err = bpf_prog_attach(prog_fd, cgroup_fd, test->attach_type, 0);

	}

	if (err < 0) {

		if (test->error == DENY_ATTACH)

			goto close_prog_fd;
@@ -1142,7 +1184,12 @@ static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring) 
close_sock_fd:

	close(sock_fd);

detach_prog:

	if (use_link) {

		if (link_fd >= 0)

			close(link_fd);

	} else {

		bpf_prog_detach2(prog_fd, cgroup_fd, test->attach_type);

	}

close_prog_fd:

	close(prog_fd);

	return ret;
@@ -1160,10 +1207,12 @@ void test_sockopt(void) 
		if (!test__start_subtest(tests[i].descr))

			continue;



		ASSERT_OK(run_test(cgroup_fd, &tests[i], false),

		ASSERT_OK(run_test(cgroup_fd, &tests[i], false, false),

			  tests[i].descr);

		ASSERT_OK(run_test(cgroup_fd, &tests[i], false, true),

			  tests[i].descr);

		if (tests[i].io_uring_support)

			ASSERT_OK(run_test(cgroup_fd, &tests[i], true),

			ASSERT_OK(run_test(cgroup_fd, &tests[i], true, false),

				  tests[i].descr);

	}