Re: [PATCH bpf-next] bpf: Fix stack out-of-bounds write in cgroup link update

[Sanghyun Park]

Hello Lehui,

Thank you for the review.

> not only BPF_PROG_TYPE_CGROUP_SOCK_ADDR, but also
> BPF_PROG_TYPE_CGROUP_SKB, BPF_PROG_TYPE_CGROUP_SOCK, etc. I think we can
> make it general.

Yes, it seems we should cover the other cgroup programs too.

> use link->link.prog->expected_attach_type

AFAIK, for CGROUP_SKB, the current program's expected_attach_type is not always
the link's actual attach type. Non-enforcing ingress and egress programs are
intentionally interchangeable for backward compatibility (ref: commit
5cf1e9145630).

I think we should validate the new program against link->attach_type while
preserving the existing compatibility rules. Let me send a v2 with a new
approach.