Commit 1a49f419 authored Sep 12, 2023 by Eduard Zingerman Committed by Martin KaFai Lau Sep 11, 2023

bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init



Fix for a bug observable under the following sequence of events:
1. Create a network device that does not support XDP offload.
2. Load a device bound XDP program with BPF_F_XDP_DEV_BOUND_ONLY flag
   (such programs are not offloaded).
3. Load a device bound XDP program with zero flags
   (such programs are offloaded).

At step (2) __bpf_prog_dev_bound_init() associates with device (1)
a dummy bpf_offload_netdev struct with .offdev field set to NULL.
At step (3) __bpf_prog_dev_bound_init() would reuse dummy struct
allocated at step (2).
However, downstream usage of the bpf_offload_netdev assumes that
.offdev field can't be NULL, e.g. in bpf_prog_offload_verifier_prep().

Adjust __bpf_prog_dev_bound_init() to require bpf_offload_netdev
with non-NULL .offdev for offloaded BPF programs.

Fixes: 2b3486bc ("bpf: Introduce device-bound XDP programs")
Reported-by:  <syzbot+291100dcb32190ec02a8@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/bpf/000000000000d97f3c060479c4f8@google.com/


Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20230912005539.2248244-2-eddyz87@gmail.com


Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

parent a34a9f1a

kernel/bpf/offload.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -199,12 +199,14 @@ static int __bpf_prog_dev_bound_init(struct bpf_prog prog, struct net_device n
		offload->netdev = netdev;

		ondev = bpf_offload_find_netdev(offload->netdev);
		if (!ondev) {
		if (bpf_prog_is_offloaded(prog->aux)) {
		/* When program is offloaded require presence of "true"
		* bpf_offload_netdev, avoid the one created for !ondev case below.
		*/
		if (bpf_prog_is_offloaded(prog->aux) && (!ondev \|\| !ondev->offdev)) {
		err = -EINVAL;
		goto err_free;
		}

		if (!ondev) {
		/* When only binding to the device, explicitly
		* create an entry in the hashtable.
		*/