| Message ID | 20220107221115.326171-1-toke@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf,v2,1/3] xdp: check prog type before updating BPF link | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Clearly marked for bpf |
| netdev/fixes_present | success | Fixes tag present in non-next series |
| netdev/subject_prefix | success | Link |
| netdev/cover_letter | warning | Series does not have a cover letter |
| netdev/patch_count | success | Link |
| netdev/header_inline | success | No static functions without inline keyword in header files |
| netdev/build_32bit | success | Errors and warnings before: 7 this patch: 7 |
| netdev/cc_maintainers | success | CCed 13 of 13 maintainers |
| netdev/build_clang | success | Errors and warnings before: 20 this patch: 20 |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Signed-off-by tag matches author and committer |
| netdev/verify_fixes | success | Fixes tag looks correct |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 9 this patch: 9 |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 12 lines checked |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/source_inline | success | Was 0 now: 0 |
| bpf/vmtest-bpf-PR | success | PR summary |
| bpf/vmtest-bpf | success | VM_Test |
On Fri, Jan 7, 2022 at 2:11 PM Toke Høiland-Jørgensen <toke@redhat.com> wrote: > > The bpf_xdp_link_update() function didn't check the program type before > updating the program, which made it possible to install any program type as > an XDP program, which is obviously not good. Syzbot managed to trigger this > by swapping in an LWT program on the XDP hook which would crash in a helper > call. > > Fix this by adding a check and bailing out if the types don't match. > > Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link") > Reported-by: syzbot+983941aa85af6ded1fd9@syzkaller.appspotmail.com > Acked-by: Andrii Nakryiko <andrii@kernel.org> > Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Thanks a lot for the quick fix! The merge window is about to begin. We will land it as soon as possible when bpf tree will be ready to accept fixes.
Alexei Starovoitov <alexei.starovoitov@gmail.com> writes: > On Fri, Jan 7, 2022 at 2:11 PM Toke Høiland-Jørgensen <toke@redhat.com> wrote: >> >> The bpf_xdp_link_update() function didn't check the program type before >> updating the program, which made it possible to install any program type as >> an XDP program, which is obviously not good. Syzbot managed to trigger this >> by swapping in an LWT program on the XDP hook which would crash in a helper >> call. >> >> Fix this by adding a check and bailing out if the types don't match. >> >> Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link") >> Reported-by: syzbot+983941aa85af6ded1fd9@syzkaller.appspotmail.com >> Acked-by: Andrii Nakryiko <andrii@kernel.org> >> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> > > Thanks a lot for the quick fix! > The merge window is about to begin. > We will land it as soon as possible when bpf tree will be ready > to accept fixes. You're welcome! That's fine; FWIW, I believe the patch applies cleanly to bpf-next as well, if that makes things easier on your end :) -Toke
On Sat, Jan 8, 2022 at 11:37 AM Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote: > > On Fri, Jan 7, 2022 at 2:11 PM Toke Høiland-Jørgensen <toke@redhat.com> wrote: > > > > The bpf_xdp_link_update() function didn't check the program type before > > updating the program, which made it possible to install any program type as > > an XDP program, which is obviously not good. Syzbot managed to trigger this > > by swapping in an LWT program on the XDP hook which would crash in a helper > > call. > > > > Fix this by adding a check and bailing out if the types don't match. > > > > Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link") > > Reported-by: syzbot+983941aa85af6ded1fd9@syzkaller.appspotmail.com > > Acked-by: Andrii Nakryiko <andrii@kernel.org> > > Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> > > Thanks a lot for the quick fix! > The merge window is about to begin. > We will land it as soon as possible when bpf tree will be ready > to accept fixes. Applied to bpf tree.
diff --git a/net/core/dev.c b/net/core/dev.c index c4708e2487fb..2078d04c6482 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -9656,6 +9656,12 @@ static int bpf_xdp_link_update(struct bpf_link *link, struct bpf_prog *new_prog, goto out_unlock; } old_prog = link->prog; + if (old_prog->type != new_prog->type || + old_prog->expected_attach_type != new_prog->expected_attach_type) { + err = -EINVAL; + goto out_unlock; + } + if (old_prog == new_prog) { /* no-op, don't disturb drivers */ bpf_prog_put(new_prog);
The bpf_xdp_link_update() function didn't check the program type before updating the program, which made it possible to install any program type as an XDP program, which is obviously not good. Syzbot managed to trigger this by swapping in an LWT program on the XDP hook which would crash in a helper call. Fix this by adding a check and bailing out if the types don't match. Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link") Reported-by: syzbot+983941aa85af6ded1fd9@syzkaller.appspotmail.com Acked-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> --- net/core/dev.c | 6 ++++++ 1 file changed, 6 insertions(+)