lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 765/846] xdp: check prog type before updating BPF link
    Date
    From: Toke Høiland-Jørgensen <toke@redhat.com>

    commit 382778edc8262b7535f00523e9eb22edba1b9816 upstream.

    The bpf_xdp_link_update() function didn't check the program type before
    updating the program, which made it possible to install any program type as
    an XDP program, which is obviously not good. Syzbot managed to trigger this
    by swapping in an LWT program on the XDP hook which would crash in a helper
    call.

    Fix this by adding a check and bailing out if the types don't match.

    Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link")
    Reported-by: syzbot+983941aa85af6ded1fd9@syzkaller.appspotmail.com
    Acked-by: Andrii Nakryiko <andrii@kernel.org>
    Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Link: https://lore.kernel.org/r/20220107221115.326171-1-toke@redhat.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/core/dev.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/net/core/dev.c
    +++ b/net/core/dev.c
    @@ -9636,6 +9636,12 @@ static int bpf_xdp_link_update(struct bp
    goto out_unlock;
    }
    old_prog = link->prog;
    + if (old_prog->type != new_prog->type ||
    + old_prog->expected_attach_type != new_prog->expected_attach_type) {
    + err = -EINVAL;
    + goto out_unlock;
    + }
    +
    if (old_prog == new_prog) {
    /* no-op, don't disturb drivers */
    bpf_prog_put(new_prog);

    \
     
     \ /
      Last update: 2022-01-25 00:46    [W:4.255 / U:2.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site