This is a note to let you know that I've just added the patch titled
xdp: check prog type before updating BPF link
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xdp-check-prog-type-before-updating-bpf-link.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 382778edc8262b7535f00523e9eb22edba1b9816 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@xxxxxxxxxx>
Date: Fri, 7 Jan 2022 23:11:13 +0100
Subject: xdp: check prog type before updating BPF link
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
commit 382778edc8262b7535f00523e9eb22edba1b9816 upstream.
The bpf_xdp_link_update() function didn't check the program type before
updating the program, which made it possible to install any program type as
an XDP program, which is obviously not good. Syzbot managed to trigger this
by swapping in an LWT program on the XDP hook which would crash in a helper
call.
Fix this by adding a check and bailing out if the types don't match.
Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link")
Reported-by: syzbot+983941aa85af6ded1fd9@xxxxxxxxxxxxxxxxxxxxxxxxx
Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20220107221115.326171-1-toke@xxxxxxxxxx
Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/core/dev.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -9339,6 +9339,12 @@ static int bpf_xdp_link_update(struct bp
goto out_unlock;
}
old_prog = link->prog;
+ if (old_prog->type != new_prog->type ||
+ old_prog->expected_attach_type != new_prog->expected_attach_type) {
+ err = -EINVAL;
+ goto out_unlock;
+ }
+
if (old_prog == new_prog) {
/* no-op, don't disturb drivers */
bpf_prog_put(new_prog);
Patches currently in stable-queue which might be from toke@xxxxxxxxxx are
queue-5.10/xdp-check-prog-type-before-updating-bpf-link.patch
queue-5.10/bpf-do-not-warn-in-bpf_warn_invalid_xdp_action.patch
