mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Matt BobrowskiandDaniel Borkmann
a6f0643e4f
When CONFIG_BPF_LSM=y is set, BPF inode storage maps
(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,
if the BPF LSM is not explicitly enabled at boot time (e.g. omitted
from the "lsm=" boot parameter), lsm_prepare() is never executed for
the BPF LSM.
Consequently, the BPF inode security blob offset
(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at
its default compiled size of 8 bytes instead of being updated to a
valid offset past the reserved struct rcu_head (typically 16 bytes
or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE
map, bpf_inode() evaluates inode->i_security + 8. This erroneously
aliases the struct rcu_head.func callback pointer at the beginning
of the inode->i_security blob. During subsequent map element cleanup
or inode destruction, writing NULL to owner_storage clears the queued
RCU callback pointer. When rcu_do_batch() later executes the queued
callback, it attempts an instruction fetch at address 0x0, triggering
an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag
marked with __ro_after_init. Set this flag to true inside bpf_lsm_init()
when the LSM framework successfully registers the BPF LSM. Gate map
allocation in inode_storage_map_alloc() on this flag, returning
-EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode
storage maps when the supporting BPF LSM infrastructure is absent,
avoiding zombie map states.
Fixes: 8ea636848a ("bpf: Implement bpf_local_storage for inodes")
Reported-by: oxsignal <awo@kakao.com>
Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/bpf/20260628201103.3624525-1-mattbobrowski@google.com
43 lines
967 B
C
43 lines
967 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
/*
|
|
* Copyright (C) 2020 Google LLC.
|
|
*/
|
|
#include <linux/lsm_hooks.h>
|
|
#include <linux/bpf_lsm.h>
|
|
#include <uapi/linux/lsm.h>
|
|
|
|
bool bpf_lsm_initialized __ro_after_init;
|
|
|
|
static struct security_hook_list bpf_lsm_hooks[] __ro_after_init = {
|
|
#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
|
|
LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),
|
|
#include <linux/lsm_hook_defs.h>
|
|
#undef LSM_HOOK
|
|
LSM_HOOK_INIT(inode_free_security, bpf_inode_storage_free),
|
|
};
|
|
|
|
static const struct lsm_id bpf_lsmid = {
|
|
.name = "bpf",
|
|
.id = LSM_ID_BPF,
|
|
};
|
|
|
|
static int __init bpf_lsm_init(void)
|
|
{
|
|
security_add_hooks(bpf_lsm_hooks, ARRAY_SIZE(bpf_lsm_hooks),
|
|
&bpf_lsmid);
|
|
bpf_lsm_initialized = true;
|
|
pr_info("LSM support for eBPF active\n");
|
|
return 0;
|
|
}
|
|
|
|
struct lsm_blob_sizes bpf_lsm_blob_sizes __ro_after_init = {
|
|
.lbs_inode = sizeof(struct bpf_storage_blob),
|
|
};
|
|
|
|
DEFINE_LSM(bpf) = {
|
|
.id = &bpf_lsmid,
|
|
.init = bpf_lsm_init,
|
|
.blobs = &bpf_lsm_blob_sizes
|
|
};
|