[PATCH bpf-next v3 5/6] bpf: Disallow !call_session_cookie progs tail-calling call_session_cookie progs

[Leon Hwang]

Fsession progs that call bpf_session_cookie() kfunc depend on
consistent session metadata stored on the stack. Mixing
!call_session_cookie progs with call_session_cookie progs via tail
calls could break this assumption.

To address this, reject the combination of !call_session_cookie progs
with call_session_cookie progs in bpf_map_owner_matches(), which
prevents the tail callee from accessing a bogus session cookie.

Also reject call_session_cookie mismatches during initialization to
prevent bypassing the above restriction.

Without this check, the above restriction can be bypassed as follows.

struct {
        __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
        __uint(max_entries, 1);
        __uint(key_size, sizeof(__u32));
        __uint(value_size, sizeof(__u32));
} jmp_table SEC(".maps");

SEC("?fsession")
int BPF_PROG(prog_a)
{
        u64 *cookie = bpf_session_cookie(ctx);

        *cookie = 42;
        bpf_tail_call_static(ctx, &jmp_table, 0);
        return 0;
}

SEC("?fsession")
int BPF_PROG(prog_b)
{
        bpf_tail_call_static(ctx, &jmp_table, 0);
        return 0;
}

The jmp_table is shared between prog_a and prog_b.

* Load prog_a first.
  At this point, owner->call_session_cookie=true.
* Load prog_b next.
  At this point, prog_b passes the compatibility check.
* Add prog_a to jmp_table.
* Attach prog_b to a kernel function.

When the kernel function runs, prog_a will get a u64 pointer to the
first arg slot on the trampoline stack, and will modify the arg via this
pointer.

Fixes: eeee4239dbb1 ("bpf: support fsession for bpf_session_cookie")
Signed-off-by: Leon Hwang <leon.hw...@linux.dev>
---
 include/linux/bpf.h | 1 +
 kernel/bpf/core.c   | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index fb978650b169..3931fdbca3a7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -290,6 +290,7 @@ struct bpf_map_owner {
        u32 sleepable:1;
        u32 kprobe_write_ctx:1;
        u32 call_get_func_ip:1;
+       u32 call_session_cookie:1;
        u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
        const struct btf_type *attach_func_proto;
        enum bpf_attach_type expected_attach_type;
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d20a90bd1d2b..5f46ac2c869b 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2392,6 +2392,7 @@ static void bpf_map_owner_init(struct bpf_map_owner 
*owner, const struct bpf_pro
        owner->sleepable = fp->sleepable;
        owner->kprobe_write_ctx = aux->kprobe_write_ctx;
        owner->call_get_func_ip = fp->call_get_func_ip;
+       owner->call_session_cookie = fp->call_session_cookie;
        owner->expected_attach_type = fp->expected_attach_type;
        owner->attach_func_proto = aux->attach_func_proto;
        for_each_cgroup_storage_type(i)
@@ -2427,6 +2428,8 @@ static bool bpf_map_owner_matches(const struct bpf_map 
*map, const struct bpf_pr
                if (has_trampoline) {
                        if (owner->call_get_func_ip != fp->call_get_func_ip)
                                return false;
+                       if (owner->call_session_cookie != 
fp->call_session_cookie)
+                               return false;
                }
                break;
 
@@ -2436,6 +2439,8 @@ static bool bpf_map_owner_matches(const struct bpf_map 
*map, const struct bpf_pr
                if (has_trampoline) {
                        if (!owner->call_get_func_ip && fp->call_get_func_ip)
                                return false;
+                       if (!owner->call_session_cookie && 
fp->call_session_cookie)
+                               return false;
                }
                break;
        }
-- 
2.52.0