Commit 70231c28 authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Tengda Wu
Browse files

bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE 

mainline inclusion
from mainline-v6.10-rc1
commit 543576ec15b17c0c93301ac8297333c7b6e84ac7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S6Q
CVE: CVE-2024-38564

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=543576ec15b17c0c93301ac8297333c7b6e84ac7

--------------------------------

bpf_prog_attach uses attach_type_to_prog_type to enforce proper
attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses
bpf_prog_get and relies on bpf_prog_attach_check_attach_type
to properly verify prog_type <> attach_type association.

Add missing attach_type enforcement for the link_create case.
Otherwise, it's currently possible to attach cgroup_skb prog
types to other cgroup hooks.

Fixes: af6eea57 ("bpf: Implement bpf_link-based cgroup BPF program attachment")
Link: https://lore.kernel.org/bpf/0000000000004792a90615a1dde0@google.com/


Reported-by: default avatar <syzbot+838346b979830606c854@syzkaller.appspotmail.com>
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20240426231621.2716876-2-sdf@google.com


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: default avatarTengda Wu <wutengda2@huawei.com>
parent 6fb08040

kernel/bpf/syscall.c

+5 −0
Original line number Diff line number Diff line
@@ -3812,6 +3812,11 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog, 
			 * check permissions at attach time.

			 */

			return -EPERM;



		ptype = attach_type_to_prog_type(attach_type);

		if (prog->type != ptype)

			return -EINVAL;



		return prog->enforce_expected_attach_type &&

			prog->expected_attach_type != attach_type ?

			-EINVAL : 0;