Commit ee7e4773 authored by Tengda Wu's avatar Tengda Wu
Browse files

bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE 

mainline inclusion
from mainline-v6.10-rc1
commit 543576ec15b17c0c93301ac8297333c7b6e84ac7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S6Q
CVE: CVE-2024-38564

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=543576ec15b17c0c93301ac8297333c7b6e84ac7

--------------------------------

bpf_prog_attach uses attach_type_to_prog_type to enforce proper
attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses
bpf_prog_get and relies on bpf_prog_attach_check_attach_type
to properly verify prog_type <> attach_type association.

Add missing attach_type enforcement for the link_create case.
Otherwise, it's currently possible to attach cgroup_skb prog
types to other cgroup hooks.

Fixes: af6eea57 ("bpf: Implement bpf_link-based cgroup BPF program attachment")
Link: https://lore.kernel.org/bpf/0000000000004792a90615a1dde0@google.com/


Reported-by: default avatar <syzbot+838346b979830606c854@syzkaller.appspotmail.com>
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20240426231621.2716876-2-sdf@google.com


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>

Conflicts:
	kernel/bpf/syscall.c
[Although this mainline patch itself has no conflicts, due to the
lack of ptype and attach_type_to_prog_type declarations which comes
from unnecessary commit db8eae6b and 3505cb9f, we fix it
manually]
Signed-off-by: default avatarTengda Wu <wutengda2@huawei.com>
parent fb08eca0

kernel/bpf/syscall.c

+30 −23
Original line number Diff line number Diff line
@@ -2945,29 +2945,6 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr) 
	return err;

}



static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,

					     enum bpf_attach_type attach_type)

{

	switch (prog->type) {

	case BPF_PROG_TYPE_CGROUP_SOCK:

	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:

	case BPF_PROG_TYPE_CGROUP_SOCKOPT:

	case BPF_PROG_TYPE_SK_LOOKUP:

		return attach_type == prog->expected_attach_type ? 0 : -EINVAL;

	case BPF_PROG_TYPE_CGROUP_SKB:

		if (!capable(CAP_NET_ADMIN))

			/* cg-skb progs can be loaded by unpriv user.

			 * check permissions at attach time.

			 */

			return -EPERM;

		return prog->enforce_expected_attach_type &&

			prog->expected_attach_type != attach_type ?

			-EINVAL : 0;

	default:

		return 0;

	}

}



static enum bpf_prog_type

attach_type_to_prog_type(enum bpf_attach_type attach_type)

{
@@ -3022,6 +2999,36 @@ attach_type_to_prog_type(enum bpf_attach_type attach_type) 
	}

}



static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,

					     enum bpf_attach_type attach_type)

{

	enum bpf_prog_type ptype;



	switch (prog->type) {

	case BPF_PROG_TYPE_CGROUP_SOCK:

	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:

	case BPF_PROG_TYPE_CGROUP_SOCKOPT:

	case BPF_PROG_TYPE_SK_LOOKUP:

		return attach_type == prog->expected_attach_type ? 0 : -EINVAL;

	case BPF_PROG_TYPE_CGROUP_SKB:

		if (!capable(CAP_NET_ADMIN))

			/* cg-skb progs can be loaded by unpriv user.

			 * check permissions at attach time.

			 */

			return -EPERM;



		ptype = attach_type_to_prog_type(attach_type);

		if (prog->type != ptype)

			return -EINVAL;



		return prog->enforce_expected_attach_type &&

			prog->expected_attach_type != attach_type ?

			-EINVAL : 0;

	default:

		return 0;

	}

}



#define BPF_PROG_ATTACH_LAST_FIELD replace_bpf_fd



#define BPF_F_ATTACH_MASK \