Unverified Commit 60cefc8d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12843 v4 CVE-2024-50063 

Merge Pull Request from: @ci-robot 
 
PR sync from: Pu Lehui <pulehui@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/WXEZU7PRX72LW5NFMVNKC5QQTNJJPDJA/ 
Pu Lehui (1):
  bpf: Fix kabi breakage in struct bpf_map

Xu Kuohai (2):
  bpf: Prevent tail call between progs attached to different hooks
  selftests/bpf: Add test for lsm tail call


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAYRIC 
 
Link:https://gitee.com/openeuler/kernel/pulls/12843

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 442847ce bdd47610

include/linux/bpf.h

+1 −1
Original line number Diff line number Diff line
@@ -306,7 +306,7 @@ struct bpf_map { 
	s64 __percpu *elem_count;



	KABI_USE(1, atomic64_t sleepable_refcnt)

	KABI_RESERVE(2)

	KABI_USE(2, const struct btf_type *attach_func_proto)

	KABI_RESERVE(3)

	KABI_RESERVE(4)

};

kernel/bpf/core.c

+18 −3
Original line number Diff line number Diff line
@@ -2259,6 +2259,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map, 
{

	enum bpf_prog_type prog_type = resolve_prog_type(fp);

	bool ret;

	struct bpf_prog_aux *aux = fp->aux;



	if (fp->kprobe_override)

		return false;
@@ -2268,7 +2269,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map, 
	 * in the case of devmap and cpumap). Until device checks

	 * are implemented, prohibit adding dev-bound programs to program maps.

	 */

	if (bpf_prog_is_dev_bound(fp->aux))

	if (bpf_prog_is_dev_bound(aux))

		return false;



	spin_lock(&map->owner.lock);
@@ -2278,12 +2279,26 @@ bool bpf_prog_map_compatible(struct bpf_map *map, 
		 */

		map->owner.type  = prog_type;

		map->owner.jited = fp->jited;

		map->owner.xdp_has_frags = fp->aux->xdp_has_frags;

		map->owner.xdp_has_frags = aux->xdp_has_frags;

		map->attach_func_proto = aux->attach_func_proto;

		ret = true;

	} else {

		ret = map->owner.type  == prog_type &&

		      map->owner.jited == fp->jited &&

		      map->owner.xdp_has_frags == fp->aux->xdp_has_frags;

		      map->owner.xdp_has_frags == aux->xdp_has_frags;

		if (ret &&

		    map->attach_func_proto != aux->attach_func_proto) {

			switch (prog_type) {

			case BPF_PROG_TYPE_TRACING:

			case BPF_PROG_TYPE_LSM:

			case BPF_PROG_TYPE_EXT:

			case BPF_PROG_TYPE_STRUCT_OPS:

				ret = false;

				break;

			default:

				break;

			}

		}

	}

	spin_unlock(&map->owner.lock);

tools/testing/selftests/bpf/prog_tests/test_lsm.c

+45 −1
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#include <stdlib.h>



#include "lsm.skel.h"

#include "lsm_tailcall.skel.h"



char *CMD_ARGS[] = {"true", NULL};
@@ -95,7 +96,7 @@ static int test_lsm(struct lsm *skel) 
	return 0;

}



void test_test_lsm(void)

static void test_lsm_basic(void)

{

	struct lsm *skel = NULL;

	int err;
@@ -114,3 +115,46 @@ void test_test_lsm(void) 
close_prog:

	lsm__destroy(skel);

}



static void test_lsm_tailcall(void)

{

	struct lsm_tailcall *skel = NULL;

	int map_fd, prog_fd;

	int err, key;



	skel = lsm_tailcall__open_and_load();

	if (!ASSERT_OK_PTR(skel, "lsm_tailcall__skel_load"))

		goto close_prog;



	map_fd = bpf_map__fd(skel->maps.jmp_table);

	if (CHECK_FAIL(map_fd < 0))

		goto close_prog;



	prog_fd = bpf_program__fd(skel->progs.lsm_file_permission_prog);

	if (CHECK_FAIL(prog_fd < 0))

		goto close_prog;



	key = 0;

	err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);

	if (CHECK_FAIL(!err))

		goto close_prog;



	prog_fd = bpf_program__fd(skel->progs.lsm_file_alloc_security_prog);

	if (CHECK_FAIL(prog_fd < 0))

		goto close_prog;



	err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);

	if (CHECK_FAIL(err))

		goto close_prog;



close_prog:

	lsm_tailcall__destroy(skel);

}



void test_test_lsm(void)

{

	if (test__start_subtest("lsm_basic"))

		test_lsm_basic();

	if (test__start_subtest("lsm_tailcall"))

		test_lsm_tailcall();

}

tools/testing/selftests/bpf/progs/lsm_tailcall.c

0 → 100644
+34 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2024 Huawei Technologies Co., Ltd */



#include "vmlinux.h"

#include <errno.h>

#include <bpf/bpf_helpers.h>



char _license[] SEC("license") = "GPL";



struct {

	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);

	__uint(max_entries, 1);

	__uint(key_size, sizeof(__u32));

	__uint(value_size, sizeof(__u32));

} jmp_table SEC(".maps");



SEC("lsm/file_permission")

int lsm_file_permission_prog(void *ctx)

{

	return 0;

}



SEC("lsm/file_alloc_security")

int lsm_file_alloc_security_prog(void *ctx)

{

	return 0;

}



SEC("lsm/file_alloc_security")

int lsm_file_alloc_security_entry(void *ctx)

{

	bpf_tail_call_static(ctx, &jmp_table, 0);

	return 0;

}