• Daniel Borkmann's avatar
    bpf: implement dummy fops for bpf objects · b1655857
    Daniel Borkmann authored
    syzkaller was able to trigger the following warning in
    do_dentry_open():
    
      WARNING: CPU: 1 PID: 4508 at fs/open.c:778 do_dentry_open+0x4ad/0xe40 fs/open.c:778
      Kernel panic - not syncing: panic_on_warn set ...
    
      CPU: 1 PID: 4508 Comm: syz-executor867 Not tainted 4.17.0+ #90
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
      [...]
       vfs_open+0x139/0x230 fs/open.c:908
       do_last fs/namei.c:3370 [inline]
       path_openat+0x1717/0x4dc0 fs/namei.c:3511
       do_filp_open+0x249/0x350 fs/namei.c:3545
       do_sys_open+0x56f/0x740 fs/open.c:1101
       __do_sys_openat fs/open.c:1128 [inline]
       __se_sys_openat fs/open.c:1122 [inline]
       __x64_sys_openat+0x9d/0x100 fs/open.c:1122
       do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Problem was that prog and map inodes in bpf fs did not
    implement a dummy file open operation that would return an
    error. The patch in do_dentry_open() checks whether f_ops
    are present and if not bails out with an error. While this
    may be fine, we really shouldn't be throwing a warning
    though. Thus follow the model similar to bad_file_ops and
    reject the request unconditionally with -EIO.
    
    Fixes: b2197755 ("bpf: add support for persistent maps/progs")
    Reported-by: syzbot+2e7fcab0f56fdbb330b8@syzkaller.appspotmail.com
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    b1655857
inode.c 13.4 KB