Commit 4b82b181a26c ("bpf: Allow pre-ordering for bpf cgroup progs")
introduced BPF_F_PREORDER to request pre-order execution across the
cgroup hierarchy, altering the effective prog array ordering.
While pl->flags stores BPF_F_PREORDER for each attached program,
__cgroup_bpf_query() currently fails to report it. When querying
attached programs (!effective_query), __cgroup_bpf_query() fills
prog_attach_flags[] with cgrp->bpf.flags[atype] for all entries,
omitting the per-program BPF_F_PREORDER attribute.
As a result, user space tools and query callers cannot distinguish
pre-ordered programs from standard multi-prog attachments via
BPF_PROG_QUERY.
Fix this by merging (pl->flags & BPF_F_PREORDER) with the cgroup-wide
flags when copying prog_attach_flags to user space. Only BPF_F_PREORDER
is extracted from pl->flags to ensure transient positioning flags (such
as BPF_F_BEFORE, BPF_F_AFTER, BPF_F_ID, or BPF_F_REPLACE) are not
leaked to user space. Also perform both ID and attach flags copies
within the same hlist iteration.
Fixes: 4b82b181a26c ("bpf: Allow pre-ordering for bpf cgroup progs")
Signed-off-by: Hui Su <[email protected]>
---
kernel/bpf/cgroup.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 149672c76c49..e7c7efa1baa7 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1353,19 +1353,19 @@ static int __cgroup_bpf_query(struct cgroup *cgrp,
const union bpf_attr *attr,
id = prog->aux->id;
if (copy_to_user(prog_ids + i, &id, sizeof(id)))
return -EFAULT;
+ if (prog_attach_flags) {
+ flags = cgrp->bpf.flags[atype] |
+ (pl->flags & BPF_F_PREORDER);
+ if (copy_to_user(prog_attach_flags + i,
+ &flags, sizeof(flags)))
+ return -EFAULT;
+ }
if (++i == cnt)
break;
}
- if (prog_attach_flags) {
- flags = cgrp->bpf.flags[atype];
-
- for (i = 0; i < cnt; i++)
- if (copy_to_user(prog_attach_flags + i,
- &flags, sizeof(flags)))
- return -EFAULT;
+ if (prog_attach_flags)
prog_attach_flags += cnt;
- }
}
prog_ids += cnt;
--
2.55.0
