diff options
| author | Toke Høiland-Jørgensen <toke@redhat.com> | 2021-03-26 11:03:13 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-04-14 08:42:00 +0200 |
| commit | b7004ecafade02c6e413b8360802b1a524cee97f (patch) | |
| tree | 263c5f82dcae3e70bf3bb479854496d872e3b472 /kernel | |
| parent | 3015db3de71545d385416a4a4e1242509343cceb (diff) | |
| download | linux-stable-b7004ecafade02c6e413b8360802b1a524cee97f.tar.gz linux-stable-b7004ecafade02c6e413b8360802b1a524cee97f.tar.bz2 linux-stable-b7004ecafade02c6e413b8360802b1a524cee97f.zip | |
bpf: Enforce that struct_ops programs be GPL-only
commit 12aa8a9467b354ef893ce0fc5719a4de4949a9fb upstream.
With the introduction of the struct_ops program type, it became possible to
implement kernel functionality in BPF, making it viable to use BPF in place
of a regular kernel module for these particular operations.
Thus far, the only user of this mechanism is for implementing TCP
congestion control algorithms. These are clearly marked as GPL-only when
implemented as modules (as seen by the use of EXPORT_SYMBOL_GPL for
tcp_register_congestion_control()), so it seems like an oversight that this
was not carried over to BPF implementations. Since this is the only user
of the struct_ops mechanism, just enforcing GPL-only for the struct_ops
program type seems like the simplest way to fix this.
Fixes: 0baf26b0fcd7 ("bpf: tcp: Support tcp_congestion_ops in bpf")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210326100314.121853-1-toke@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 9a1aba2d0073..12cd2997f982 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11429,6 +11429,11 @@ static int check_struct_ops_btf_id(struct bpf_verifier_env *env) u32 btf_id, member_idx; const char *mname; + if (!prog->gpl_compatible) { + verbose(env, "struct ops programs must have a GPL compatible license\n"); + return -EINVAL; + } + btf_id = prog->aux->attach_btf_id; st_ops = bpf_struct_ops_find(btf_id); if (!st_ops) { |