diff options
| author |   Xu Kuohai <xukuohai@huawei.com> | 2024-07-19 19:00:52 +0800 |
|---|---|---|
| committer |   Andrii Nakryiko <andrii@kernel.org> | 2024-07-29 13:09:22 -0700 |
| commit | 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 (patch) | |
| tree | 006d24765b0fd8fdff944e4924a2f75149f78471 /include/linux/bpf.h | |
| parent | bpf, lsm: Add disabled BPF LSM hook list (diff) | |
| download | wireguard-linux-5d99e198be279045e6ecefe220f5c52f8ce9bfd5.tar.xz wireguard-linux-5d99e198be279045e6ecefe220f5c52f8ce9bfd5.zip | |
bpf, lsm: Add check for BPF LSM return value
A bpf prog returning a positive number attached to file_alloc_security
hook makes kernel panic.
This happens because file system can not filter out the positive number
returned by the LSM prog using IS_ERR, and misinterprets this positive
number as a file pointer.
Given that hook file_alloc_security never returned positive number
before the introduction of BPF LSM, and other BPF LSM hooks may
encounter similar issues, this patch adds LSM return value check
in verifier, to ensure no unexpected value is returned.
Fixes: 520b7aa00d8c ("bpf: lsm: Initialize the BPF LSM hooks")
Reported-by: Xin Liu <liuxin350@huawei.com>
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20240719110059.797546-3-xukuohai@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Diffstat (limited to 'include/linux/bpf.h')
| -rw-r--r-- | include/linux/bpf.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 4c54864316ee..5739cc9986f8 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -927,6 +927,7 @@ struct bpf_insn_access_aux { }; }; struct bpf_verifier_log *log; /* for verbose logs */ + bool is_retval; /* is accessing function return value ? */ }; static inline void |