mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Matt BobrowskiandDaniel Borkmann
a6f0643e4f
When CONFIG_BPF_LSM=y is set, BPF inode storage maps
(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,
if the BPF LSM is not explicitly enabled at boot time (e.g. omitted
from the "lsm=" boot parameter), lsm_prepare() is never executed for
the BPF LSM.
Consequently, the BPF inode security blob offset
(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at
its default compiled size of 8 bytes instead of being updated to a
valid offset past the reserved struct rcu_head (typically 16 bytes
or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE
map, bpf_inode() evaluates inode->i_security + 8. This erroneously
aliases the struct rcu_head.func callback pointer at the beginning
of the inode->i_security blob. During subsequent map element cleanup
or inode destruction, writing NULL to owner_storage clears the queued
RCU callback pointer. When rcu_do_batch() later executes the queued
callback, it attempts an instruction fetch at address 0x0, triggering
an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag
marked with __ro_after_init. Set this flag to true inside bpf_lsm_init()
when the LSM framework successfully registers the BPF LSM. Gate map
allocation in inode_storage_map_alloc() on this flag, returning
-EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode
storage maps when the supporting BPF LSM infrastructure is absent,
avoiding zombie map states.
Fixes: 8ea636848a ("bpf: Implement bpf_local_storage for inodes")
Reported-by: oxsignal <awo@kakao.com>
Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/bpf/20260628201103.3624525-1-mattbobrowski@google.com
120 lines
2.9 KiB
C
120 lines
2.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
/*
|
|
* Copyright (C) 2020 Google LLC.
|
|
*/
|
|
|
|
#ifndef _LINUX_BPF_LSM_H
|
|
#define _LINUX_BPF_LSM_H
|
|
|
|
#include <linux/sched.h>
|
|
#include <linux/bpf.h>
|
|
#include <linux/bpf_verifier.h>
|
|
#include <linux/lsm_hooks.h>
|
|
|
|
#ifdef CONFIG_BPF_LSM
|
|
|
|
extern bool bpf_lsm_initialized __ro_after_init;
|
|
|
|
#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
|
|
RET bpf_lsm_##NAME(__VA_ARGS__);
|
|
#include <linux/lsm_hook_defs.h>
|
|
#undef LSM_HOOK
|
|
|
|
struct bpf_storage_blob {
|
|
struct bpf_local_storage __rcu *storage;
|
|
};
|
|
|
|
extern struct lsm_blob_sizes bpf_lsm_blob_sizes;
|
|
|
|
int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
|
|
const struct bpf_prog *prog);
|
|
|
|
bool bpf_lsm_is_sleepable_hook(u32 btf_id);
|
|
bool bpf_lsm_is_trusted(const struct bpf_prog *prog);
|
|
|
|
static inline struct bpf_storage_blob *bpf_inode(
|
|
const struct inode *inode)
|
|
{
|
|
if (unlikely(!inode->i_security))
|
|
return NULL;
|
|
|
|
return inode->i_security + bpf_lsm_blob_sizes.lbs_inode;
|
|
}
|
|
|
|
extern const struct bpf_func_proto bpf_inode_storage_get_proto;
|
|
extern const struct bpf_func_proto bpf_inode_storage_delete_proto;
|
|
void bpf_inode_storage_free(struct inode *inode);
|
|
|
|
void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func);
|
|
|
|
int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
|
|
struct bpf_retval_range *range);
|
|
int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str,
|
|
const struct bpf_dynptr *value_p, int flags);
|
|
int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str);
|
|
bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog);
|
|
bool bpf_lsm_hook_returns_errno(u32 btf_id);
|
|
|
|
#else /* !CONFIG_BPF_LSM */
|
|
|
|
#define bpf_lsm_initialized false
|
|
|
|
static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline bool bpf_lsm_is_trusted(const struct bpf_prog *prog)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
|
|
const struct bpf_prog *prog)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline struct bpf_storage_blob *bpf_inode(
|
|
const struct inode *inode)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
static inline void bpf_inode_storage_free(struct inode *inode)
|
|
{
|
|
}
|
|
|
|
static inline void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
|
|
bpf_func_t *bpf_func)
|
|
{
|
|
}
|
|
|
|
static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
|
|
struct bpf_retval_range *range)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
static inline int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str,
|
|
const struct bpf_dynptr *value_p, int flags)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
static inline int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
static inline bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline bool bpf_lsm_hook_returns_errno(u32 btf_id)
|
|
{
|
|
return true;
|
|
}
|
|
#endif /* CONFIG_BPF_LSM */
|
|
|
|
#endif /* _LINUX_BPF_LSM_H */
|