diff options
| author | Junseo Lim <zirajs7@gmail.com> | 2026-08-12 18:16:54 +0900 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2026-08-17 11:10:09 +0200 |
| commit | 84473a7e1813a2da7b759ab1d098a84998c8d3f5 (patch) | |
| tree | 5c1cf6b819108454dc03772ec5e65e472b807b2b /net | |
| parent | 5fe7007aed9ad069b2bd77e5d0c875c64f5c0269 (diff) | |
| download | linux-next-84473a7e1813a2da7b759ab1d098a84998c8d3f5.tar.gz linux-next-84473a7e1813a2da7b759ab1d098a84998c8d3f5.zip | |
bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
_bpf_setsockopt() and _bpf_getsockopt() call sock_owned_by_me() for
full sockets, so these helpers expect the socket lock to be held.
BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME run BPF
programs without acquiring the socket lock. A program attached to
either hook can therefore trigger the sock_owned_by_me() warning by
calling bpf_setsockopt() or bpf_getsockopt().
Disallow bpf_setsockopt() and bpf_getsockopt() for CGROUP_UNIX_GETPEERNAME
and CGROUP_UNIX_GETSOCKNAME.
Fixes: 859051dd165e ("bpf: Implement cgroup sockaddr hooks for unix sockets")
Reported-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Junseo Lim <zirajs7@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://lore.kernel.org/bpf/20260812091654.244752-1-zirajs7@gmail.com
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/filter.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 79cbef41af59..4a38c9b33bc9 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8428,10 +8428,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: - case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: - case BPF_CGROUP_UNIX_GETSOCKNAME: return &bpf_sock_addr_setsockopt_proto; default: return NULL; @@ -8451,10 +8449,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: - case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: - case BPF_CGROUP_UNIX_GETSOCKNAME: return &bpf_sock_addr_getsockopt_proto; default: return NULL; |