Re: [PATCH 5.15.y] bpf: Enforce expected_attach_type for tailcall compatibility

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] The new `expected_attach_type` enforcement for `PROG_ARRAY` maps can be completely bypassed using `BPF_PROG_TYPE_EXT` (extension) programs, allowing execution of restricted helpers in the wrong context.

Pre-existing issues:
- [Critical] A logic bug in `__bpf_prog_map_compatible` bypasses the `attach_func_proto` compatibility check for `BPF_PROG_TYPE_EXT` programs, allowing normal programs to tail call into them with incompatible register states.
--

commit e59631235c69f576df8b0685292dedba6977c75e
Author: Daniel Borkmann <daniel@iogearbox.net>
Subject: bpf: Enforce expected_attach_type for tailcall compatibility

This patch updates tailcall map compatibility checks to enforce that the
expected_attach_type of the map owner matches the expected_attach_type of
the program being inserted. This prevents programs with different contextual
restrictions from bypassing verifier constraints via tailcalls.

Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
[ ... ]
> @@ -1866,6 +1867,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
>  		      map->owner->jited == fp->jited;
>  		/* Note: xdp_has_frags check would go here when available */
>  		/* && map->owner->xdp_has_frags == aux->xdp_has_frags; */
> +		if (ret &&
> +		    map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
> +		    map->owner->expected_attach_type != fp->expected_attach_type)
> +			ret = false;

[Severity: High]
Does this new check fully prevent expected_attach_type mismatches when
BPF_PROG_TYPE_EXT programs are involved?

In bpf_check(), the verifier clears env->prog->expected_attach_type to 0
for BPF_PROG_TYPE_EXT programs after verification. If an EXT program uses
a tail call, the PROG_ARRAY map owner is assigned an expected_attach_type
of 0.

If another EXT program with a different target but the same base type
attempts to tail-call into it, both will have their expected_attach_type
set to 0. Because 0 == 0, the check here passes, which seems to allow them
to bypass the boundary intended by this fix.

[Severity: Critical]
This is a pre-existing issue, but I noticed the attach_func_proto mismatch
is also bypassed for EXT programs in this same function.

Earlier in __bpf_prog_map_compatible(), prog_type is determined using the
target's type:

	enum bpf_prog_type prog_type = fp->aux->dst_prog ? 
				       fp->aux->dst_prog->type : fp->type;

Later, the mismatch check relies on this prog_type:

	switch (prog_type) {
	case BPF_PROG_TYPE_TRACING:
	case BPF_PROG_TYPE_LSM:
	case BPF_PROG_TYPE_EXT:
	case BPF_PROG_TYPE_STRUCT_OPS:
		ret = false;
		break;
	default:
		break;
	}

When an EXT program is inserted into a PROG_ARRAY (e.g., a standard XDP
map), prog_type evaluates to the target's type (BPF_PROG_TYPE_XDP). Because
it evaluates to XDP, it hits the default case in the switch statement
instead of the BPF_PROG_TYPE_EXT case. 

Could this bypass the rejection for mismatched function prototypes and allow
a normal program to tail call into the EXT program with incompatible
register states?

>  		for_each_cgroup_storage_type(i) {
>  			if (!ret)
>  				break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910-cve-2025-40123-5-15-v1-1-547774d4a00b@bootlin.com?part=1