mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
synced 2024-12-28 16:52:18 +00:00
5d99e198be
A bpf prog returning a positive number attached to file_alloc_security
hook makes kernel panic.
This happens because file system can not filter out the positive number
returned by the LSM prog using IS_ERR, and misinterprets this positive
number as a file pointer.
Given that hook file_alloc_security never returned positive number
before the introduction of BPF LSM, and other BPF LSM hooks may
encounter similar issues, this patch adds LSM return value check
in verifier, to ensure no unexpected value is returned.
Fixes: 520b7aa00d ("bpf: lsm: Initialize the BPF LSM hooks")
Reported-by: Xin Liu <liuxin350@huawei.com>
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20240719110059.797546-3-xukuohai@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
92 lines
2.0 KiB
C
92 lines
2.0 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
/*
|
|
* Copyright (C) 2020 Google LLC.
|
|
*/
|
|
|
|
#ifndef _LINUX_BPF_LSM_H
|
|
#define _LINUX_BPF_LSM_H
|
|
|
|
#include <linux/sched.h>
|
|
#include <linux/bpf.h>
|
|
#include <linux/bpf_verifier.h>
|
|
#include <linux/lsm_hooks.h>
|
|
|
|
#ifdef CONFIG_BPF_LSM
|
|
|
|
#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
|
|
RET bpf_lsm_##NAME(__VA_ARGS__);
|
|
#include <linux/lsm_hook_defs.h>
|
|
#undef LSM_HOOK
|
|
|
|
struct bpf_storage_blob {
|
|
struct bpf_local_storage __rcu *storage;
|
|
};
|
|
|
|
extern struct lsm_blob_sizes bpf_lsm_blob_sizes;
|
|
|
|
int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
|
|
const struct bpf_prog *prog);
|
|
|
|
bool bpf_lsm_is_sleepable_hook(u32 btf_id);
|
|
bool bpf_lsm_is_trusted(const struct bpf_prog *prog);
|
|
|
|
static inline struct bpf_storage_blob *bpf_inode(
|
|
const struct inode *inode)
|
|
{
|
|
if (unlikely(!inode->i_security))
|
|
return NULL;
|
|
|
|
return inode->i_security + bpf_lsm_blob_sizes.lbs_inode;
|
|
}
|
|
|
|
extern const struct bpf_func_proto bpf_inode_storage_get_proto;
|
|
extern const struct bpf_func_proto bpf_inode_storage_delete_proto;
|
|
void bpf_inode_storage_free(struct inode *inode);
|
|
|
|
void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func);
|
|
|
|
int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
|
|
struct bpf_retval_range *range);
|
|
#else /* !CONFIG_BPF_LSM */
|
|
|
|
static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline bool bpf_lsm_is_trusted(const struct bpf_prog *prog)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
|
|
const struct bpf_prog *prog)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline struct bpf_storage_blob *bpf_inode(
|
|
const struct inode *inode)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
static inline void bpf_inode_storage_free(struct inode *inode)
|
|
{
|
|
}
|
|
|
|
static inline void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
|
|
bpf_func_t *bpf_func)
|
|
{
|
|
}
|
|
|
|
static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
|
|
struct bpf_retval_range *range)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
#endif /* CONFIG_BPF_LSM */
|
|
|
|
#endif /* _LINUX_BPF_LSM_H */
|