Commit 4ac2add6 authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Alexei Starovoitov
Browse files

bpf: flow_dissector: Check value of unused flags to BPF_PROG_DETACH 



Using BPF_PROG_DETACH on a flow dissector program supports neither
attach_flags nor attach_bpf_fd. Yet no value is enforced for them.

Enforce that attach_flags are zero, and require the current program
to be passed via attach_bpf_fd. This allows us to remove the check
for CAP_SYS_ADMIN, since userspace can now no longer remove
arbitrary flow dissector programs.

Fixes: b27f7bb5 ("flow_dissector: Move out netns_bpf prog callbacks")
Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200629095630.7933-3-lmb@cloudflare.com
parent 1b514239

include/linux/bpf-netns.h

+3 −2
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ int netns_bpf_prog_query(const union bpf_attr *attr, 
			 union bpf_attr __user *uattr);

int netns_bpf_prog_attach(const union bpf_attr *attr,

			  struct bpf_prog *prog);

int netns_bpf_prog_detach(const union bpf_attr *attr);

int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);

int netns_bpf_link_create(const union bpf_attr *attr,

			  struct bpf_prog *prog);

#else
@@ -49,7 +49,8 @@ static inline int netns_bpf_prog_attach(const union bpf_attr *attr, 
	return -EOPNOTSUPP;

}



static inline int netns_bpf_prog_detach(const union bpf_attr *attr)

static inline int netns_bpf_prog_detach(const union bpf_attr *attr,

					enum bpf_prog_type ptype)

{

	return -EOPNOTSUPP;

}

kernel/bpf/net_namespace.c

+15 −4
Original line number Diff line number Diff line
@@ -269,7 +269,8 @@ out_unlock: 


/* Must be called with netns_bpf_mutex held. */

static int __netns_bpf_prog_detach(struct net *net,

				   enum netns_bpf_attach_type type)

				   enum netns_bpf_attach_type type,

				   struct bpf_prog *old)

{

	struct bpf_prog *attached;
@@ -278,7 +279,7 @@ static int __netns_bpf_prog_detach(struct net *net, 
		return -EINVAL;



	attached = net->bpf.progs[type];

	if (!attached)

	if (!attached || attached != old)

		return -ENOENT;

	netns_bpf_run_array_detach(net, type);

	net->bpf.progs[type] = NULL;
@@ -286,19 +287,29 @@ static int __netns_bpf_prog_detach(struct net *net, 
	return 0;

}



int netns_bpf_prog_detach(const union bpf_attr *attr)

int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)

{

	enum netns_bpf_attach_type type;

	struct bpf_prog *prog;

	int ret;



	if (attr->target_fd)

		return -EINVAL;



	type = to_netns_bpf_attach_type(attr->attach_type);

	if (type < 0)

		return -EINVAL;



	prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype);

	if (IS_ERR(prog))

		return PTR_ERR(prog);



	mutex_lock(&netns_bpf_mutex);

	ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type);

	ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type, prog);

	mutex_unlock(&netns_bpf_mutex);



	bpf_prog_put(prog);



	return ret;

}

kernel/bpf/syscall.c

+1 −3
Original line number Diff line number Diff line
@@ -2897,9 +2897,7 @@ static int bpf_prog_detach(const union bpf_attr *attr) 
	case BPF_PROG_TYPE_LIRC_MODE2:

		return lirc_prog_detach(attr);

	case BPF_PROG_TYPE_FLOW_DISSECTOR:

		if (!capable(CAP_NET_ADMIN))

			return -EPERM;

		return netns_bpf_prog_detach(attr);

		return netns_bpf_prog_detach(attr, ptype);

	case BPF_PROG_TYPE_CGROUP_DEVICE:

	case BPF_PROG_TYPE_CGROUP_SKB:

	case BPF_PROG_TYPE_CGROUP_SOCK:

CRA Git | Maintained and supported by SUSTech CRA and CCSE