bpf: Fix bpf_attr.attach_btf_id check (c108e3c1) · Commits · 戴 / test

Only raw_tracepoint program type can have bpf_attr.attach_btf_id >= 0. Make sure to reject other program types that accidentally set it to non-zero. Fixes: ("bpf: Add attach_btf_id attribute to program load") Reported-by:

Andrii Nakryiko <andriin@fb.com> Signed-off-by:

Alexei Starovoitov <ast@kernel.org> Signed-off-by:

Daniel Borkmann <daniel@iogearbox.net> Acked-by:

Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20191018060933.2950231-1-ast@kernel.org

kernel/bpf/syscall.c

+11 −6

Original line number	Diff line number	Diff line
		@@ -1570,6 +1570,17 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type,
		enum bpf_attach_type expected_attach_type,
		u32 btf_id)
		{
		switch (prog_type) {
		case BPF_PROG_TYPE_RAW_TRACEPOINT:
		if (btf_id > BTF_MAX_TYPE)
		return -EINVAL;
		break;
		default:
		if (btf_id)
		return -EINVAL;
		break;
		}

		switch (prog_type) {
		case BPF_PROG_TYPE_CGROUP_SOCK:
		switch (expected_attach_type) {
		@@ -1610,13 +1621,7 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type,
		default:
		return -EINVAL;
		}
		case BPF_PROG_TYPE_RAW_TRACEPOINT:
		if (btf_id > BTF_MAX_TYPE)
		return -EINVAL;
		return 0;
		default:
		if (btf_id)
		return -EINVAL;
		return 0;
		}
		}

Admin message