xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpf: flow_dissector: Check value of unused flags to BPF_PROG_DETACH

Browse Source 
Using BPF_PROG_DETACH on a flow dissector program supports neither
attach_flags nor attach_bpf_fd. Yet no value is enforced for them.

Enforce that attach_flags are zero, and require the current program
to be passed via attach_bpf_fd. This allows us to remove the check
for CAP_SYS_ADMIN, since userspace can now no longer remove
arbitrary flow dissector programs.

Fixes: b27f7bb590 ("flow_dissector: Move out netns_bpf prog callbacks")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200629095630.7933-3-lmb@cloudflare.com
This commit is contained in:
Lorenz Bauer
2020-06-29 10:56:26 +01:00
committed by Alexei Starovoitov
parent 1b514239e8
commit 4ac2add659
3 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/linux/bpf-netns.h
View File

@@ -33,7 +33,7 @@ int netns_bpf_prog_query(const union bpf_attr *attr,
union bpf_attr __user *uattr); union bpf_attr __user *uattr);
int netns_bpf_prog_attach(const union bpf_attr *attr, int netns_bpf_prog_attach(const union bpf_attr *attr,
struct bpf_prog *prog); struct bpf_prog *prog);
int netns_bpf_prog_detach(const union bpf_attr *attr); int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);
int netns_bpf_link_create(const union bpf_attr *attr, int netns_bpf_link_create(const union bpf_attr *attr,
struct bpf_prog *prog); struct bpf_prog *prog);
#else #else
@@ -49,7 +49,8 @@ static inline int netns_bpf_prog_attach(const union bpf_attr *attr,
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
static inline int netns_bpf_prog_detach(const union bpf_attr *attr) static inline int netns_bpf_prog_detach(const union bpf_attr *attr,
enum bpf_prog_type ptype)
{ {
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }

19
kernel/bpf/net_namespace.c
View File

@@ -269,7 +269,8 @@ out_unlock:
/* Must be called with netns_bpf_mutex held. */ /* Must be called with netns_bpf_mutex held. */
static int __netns_bpf_prog_detach(struct net *net, static int __netns_bpf_prog_detach(struct net *net,
enum netns_bpf_attach_type type) enum netns_bpf_attach_type type,
struct bpf_prog *old)
{ {
struct bpf_prog *attached; struct bpf_prog *attached;
@@ -278,7 +279,7 @@ static int __netns_bpf_prog_detach(struct net *net,
return -EINVAL; return -EINVAL;
attached = net->bpf.progs[type]; attached = net->bpf.progs[type];
if (!attached) if (!attached || attached != old)
return -ENOENT; return -ENOENT;
netns_bpf_run_array_detach(net, type); netns_bpf_run_array_detach(net, type);
net->bpf.progs[type] = NULL; net->bpf.progs[type] = NULL;
@@ -286,19 +287,29 @@ static int __netns_bpf_prog_detach(struct net *net,
return 0; return 0;
} }
int netns_bpf_prog_detach(const union bpf_attr *attr) int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)
{ {
enum netns_bpf_attach_type type; enum netns_bpf_attach_type type;
struct bpf_prog *prog;
int ret; int ret;
if (attr->target_fd)
return -EINVAL;
type = to_netns_bpf_attach_type(attr->attach_type); type = to_netns_bpf_attach_type(attr->attach_type);
if (type < 0) if (type < 0)
return -EINVAL; return -EINVAL;
prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype);
if (IS_ERR(prog))
return PTR_ERR(prog);
mutex_lock(&netns_bpf_mutex); mutex_lock(&netns_bpf_mutex);
ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type); ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type, prog);
mutex_unlock(&netns_bpf_mutex); mutex_unlock(&netns_bpf_mutex);
bpf_prog_put(prog);
return ret; return ret;
} }

4
kernel/bpf/syscall.c
View File

@@ -2897,9 +2897,7 @@ static int bpf_prog_detach(const union bpf_attr *attr)
case BPF_PROG_TYPE_LIRC_MODE2: case BPF_PROG_TYPE_LIRC_MODE2:
return lirc_prog_detach(attr); return lirc_prog_detach(attr);
case BPF_PROG_TYPE_FLOW_DISSECTOR: case BPF_PROG_TYPE_FLOW_DISSECTOR:
if (!capable(CAP_NET_ADMIN)) return netns_bpf_prog_detach(attr, ptype);
return -EPERM;
return netns_bpf_prog_detach(attr);
case BPF_PROG_TYPE_CGROUP_DEVICE: case BPF_PROG_TYPE_CGROUP_DEVICE:
case BPF_PROG_TYPE_CGROUP_SKB: case BPF_PROG_TYPE_CGROUP_SKB:
case BPF_PROG_TYPE_CGROUP_SOCK: case BPF_PROG_TYPE_CGROUP_SOCK: