[PATCH bpf-next v3 5/8] bpf: Restrict bpf_sock_destroy() to iter/{tcp,udp}

[Michal Luczaj]

A subsequent patch will mark bpf_iter__sockmap::sk as PTR_TRUSTED, making
bpf_sock_destroy() callable from the iter/sockmap. Unlike iter/{tcp,udp},
the sockmap iterator does not run progs with the socket lock held, so
destroying a socket from that context is unsafe. Restrict the allowed
callers of bpf_sock_destroy() to iter/{tcp,udp}.

Suggested-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
---
 net/core/filter.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 9245009d9f1e..6a67bc2a0c4b 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -13072,11 +13072,20 @@ BTF_KFUNCS_START(bpf_sk_iter_kfunc_ids)
 BTF_ID_FLAGS(func, bpf_sock_destroy)
 BTF_KFUNCS_END(bpf_sk_iter_kfunc_ids)
 
+BTF_SET_START(bpf_sk_iter_locked_ids)
+#if defined(CONFIG_INET) && defined(CONFIG_PROC_FS)
+BTF_ID(func, bpf_iter_tcp)
+BTF_ID(func, bpf_iter_udp)
+#endif
+BTF_SET_END(bpf_sk_iter_locked_ids)
+
 static int tracing_iter_filter(const struct bpf_prog *prog, u32 kfunc_id)
 {
 	if (btf_id_set8_contains(&bpf_sk_iter_kfunc_ids, kfunc_id) &&
-	    prog->expected_attach_type != BPF_TRACE_ITER)
+	    (prog->expected_attach_type != BPF_TRACE_ITER ||
+	     !btf_id_set_contains(&bpf_sk_iter_locked_ids, prog->aux->attach_btf_id)))
 		return -EACCES;
+
 	return 0;
 }
 

-- 
2.56.0