Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca7ace8f authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Greg Kroah-Hartman
Browse files

bpf: sockmap: Require attach_bpf_fd when detaching a program 



commit bb0de3131f4c60a9bf976681e0fe4d1e55c7a821 upstream.

The sockmap code currently ignores the value of attach_bpf_fd when
detaching a program. This is contrary to the usual behaviour of
checking that attach_bpf_fd represents the currently attached
program.

Ensure that attach_bpf_fd is indeed the currently attached
program. It turns out that all sockmap selftests already do this,
which indicates that this is unlikely to cause breakage.

Fixes: 604326b4 ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200629095630.7933-5-lmb@cloudflare.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9fe975ac

include/linux/bpf.h

+11 −2
Original line number Diff line number Diff line
@@ -956,11 +956,14 @@ static inline void bpf_map_offload_map_free(struct bpf_map *map) 
#endif /* CONFIG_NET && CONFIG_BPF_SYSCALL */



#if defined(CONFIG_BPF_STREAM_PARSER)

int sock_map_prog_update(struct bpf_map *map, struct bpf_prog *prog, u32 which);

int sock_map_prog_update(struct bpf_map *map, struct bpf_prog *prog,

			 struct bpf_prog *old, u32 which);

int sock_map_get_from_fd(const union bpf_attr *attr, struct bpf_prog *prog);

int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);

#else

static inline int sock_map_prog_update(struct bpf_map *map,

				       struct bpf_prog *prog, u32 which)

				       struct bpf_prog *prog,

				       struct bpf_prog *old, u32 which)

{

	return -EOPNOTSUPP;

}
@@ -970,6 +973,12 @@ static inline int sock_map_get_from_fd(const union bpf_attr *attr, 
{

	return -EINVAL;

}



static inline int sock_map_prog_detach(const union bpf_attr *attr,

				       enum bpf_prog_type ptype)

{

	return -EOPNOTSUPP;

}

#endif



#if defined(CONFIG_XDP_SOCKETS)

include/linux/skmsg.h

+13 −0
Original line number Diff line number Diff line
@@ -450,6 +450,19 @@ static inline void psock_set_prog(struct bpf_prog **pprog, 
		bpf_prog_put(prog);

}



static inline int psock_replace_prog(struct bpf_prog **pprog,

				     struct bpf_prog *prog,

				     struct bpf_prog *old)

{

	if (cmpxchg(pprog, old, prog) != old)

		return -ENOENT;



	if (old)

		bpf_prog_put(old);



	return 0;

}



static inline void psock_progs_drop(struct sk_psock_progs *progs)

{

	psock_set_prog(&progs->msg_parser, NULL);

kernel/bpf/syscall.c

+2 −2
Original line number Diff line number Diff line
@@ -2029,10 +2029,10 @@ static int bpf_prog_detach(const union bpf_attr *attr) 
		ptype = BPF_PROG_TYPE_CGROUP_DEVICE;

		break;

	case BPF_SK_MSG_VERDICT:

		return sock_map_get_from_fd(attr, NULL);

		return sock_map_prog_detach(attr, BPF_PROG_TYPE_SK_MSG);

	case BPF_SK_SKB_STREAM_PARSER:

	case BPF_SK_SKB_STREAM_VERDICT:

		return sock_map_get_from_fd(attr, NULL);

		return sock_map_prog_detach(attr, BPF_PROG_TYPE_SK_SKB);

	case BPF_LIRC_MODE2:

		return lirc_prog_detach(attr);

	case BPF_FLOW_DISSECTOR:

net/core/sock_map.c

+45 −5
Original line number Diff line number Diff line
@@ -71,7 +71,42 @@ int sock_map_get_from_fd(const union bpf_attr *attr, struct bpf_prog *prog) 
	map = __bpf_map_get(f);

	if (IS_ERR(map))

		return PTR_ERR(map);

	ret = sock_map_prog_update(map, prog, attr->attach_type);

	ret = sock_map_prog_update(map, prog, NULL, attr->attach_type);

	fdput(f);

	return ret;

}



int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)

{

	u32 ufd = attr->target_fd;

	struct bpf_prog *prog;

	struct bpf_map *map;

	struct fd f;

	int ret;



	if (attr->attach_flags)

		return -EINVAL;



	f = fdget(ufd);

	map = __bpf_map_get(f);

	if (IS_ERR(map))

		return PTR_ERR(map);



	prog = bpf_prog_get(attr->attach_bpf_fd);

	if (IS_ERR(prog)) {

		ret = PTR_ERR(prog);

		goto put_map;

	}



	if (prog->type != ptype) {

		ret = -EINVAL;

		goto put_prog;

	}



	ret = sock_map_prog_update(map, NULL, prog, attr->attach_type);

put_prog:

	bpf_prog_put(prog);

put_map:

	fdput(f);

	return ret;

}
@@ -1015,27 +1050,32 @@ static struct sk_psock_progs *sock_map_progs(struct bpf_map *map) 
}



int sock_map_prog_update(struct bpf_map *map, struct bpf_prog *prog,

			 u32 which)

			 struct bpf_prog *old, u32 which)

{

	struct sk_psock_progs *progs = sock_map_progs(map);

	struct bpf_prog **pprog;



	if (!progs)

		return -EOPNOTSUPP;



	switch (which) {

	case BPF_SK_MSG_VERDICT:

		psock_set_prog(&progs->msg_parser, prog);

		pprog = &progs->msg_parser;

		break;

	case BPF_SK_SKB_STREAM_PARSER:

		psock_set_prog(&progs->skb_parser, prog);

		pprog = &progs->skb_parser;

		break;

	case BPF_SK_SKB_STREAM_VERDICT:

		psock_set_prog(&progs->skb_verdict, prog);

		pprog = &progs->skb_verdict;

		break;

	default:

		return -EOPNOTSUPP;

	}



	if (old)

		return psock_replace_prog(pprog, prog, old);



	psock_set_prog(pprog, prog);

	return 0;

}