[PATCH bpf-next] bpf: Fix stack out-of-bounds write in cgroup link update

[Sanghyun Park]

The cgroup link update path checks only the program type, allowing a UDP6
sock_addr program to replace the program on a UDP4 link. Running the
replacement writes past the smaller IPv4 context into ipcm_cookie::opt on the
stack.

Require a replacement sock_addr program to have the same expected attach type
as the link before changing link state. Limit the check to sock_addr programs
so update policy for other cgroup program types remains unchanged.

Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@xxxxxxxxx>
---
 kernel/bpf/cgroup.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index d2da5063d8f8..65bf25deac4f 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1055,6 +1055,10 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
 	if (link->link.prog->type != new_prog->type)
 		return -EINVAL;
 
+	if (new_prog->type == BPF_PROG_TYPE_CGROUP_SOCK_ADDR &&
+	    link->link.attach_type != new_prog->expected_attach_type)
+		return -EINVAL;
+
 	hlist_for_each_entry(pl, progs, node) {
 		if (pl->link == link) {
 			found = true;
-- 
2.48.1