[PATCH 5.15.y] bpf: Enforce expected_attach_type for tailcall compatibility

[PATCH 5.15.y] bpf: Enforce expected_attach_type for tailcall compatibility

[Miguel Gazquez (Schneider Electric)]

From: Daniel Borkmann <daniel@iogearbox.net>

[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]

Yinhao et al. recently reported:

  Our fuzzer tool discovered an uninitialized pointer issue in the
  bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
  This leads to a NULL pointer dereference when a BPF program attempts to
  deference the txq member of struct xdp_buff object.

The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
egress_ifindex, and the latter is only allowed to be accessed under mentioned
expected_attach_type. progB is then inserted into the tailcall which progA
calls.

The underlying issue goes beyond XDP though. Another example are programs
of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
as sock_addr_func_proto() have different logic depending on the programs'
expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
should not be allowed doing a tailcall into a program which calls bpf_bind()
out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.

In short, specifying expected_attach_type allows to open up additional
functionality or restrictions beyond what the basic bpf_prog_type enables.
The use of tailcalls must not violate these constraints. Fix it by enforcing
expected_attach_type in __bpf_prog_map_compatible().

Note that we only enforce this for tailcall maps, but not for BPF devmaps or
cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
these situations are not prone to this issue.

Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Signed-off-by: Miguel Gazquez (Schneider Electric) <miguel.gazquez@bootlin.com>
---
 include/linux/bpf.h | 1 +
 kernel/bpf/core.c   | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ed42bac04a79..e9081b1ec436 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -259,6 +259,7 @@ struct bpf_map_owner {
 	bool xdp_has_frags;
 	u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
 	const struct btf_type *attach_func_proto;
+	enum bpf_attach_type expected_attach_type;
 };
 
 struct bpf_map {
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index ac921214059f..bbf95bc2d408 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1854,6 +1854,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		map->owner->jited = fp->jited;
 		/* Note: xdp_has_frags doesn't exist in aux yet in our branch */
 		/* map->owner->xdp_has_frags = aux->xdp_has_frags; */
+		map->owner->expected_attach_type = fp->expected_attach_type;
 		map->owner->attach_func_proto = aux->attach_func_proto;
 		for_each_cgroup_storage_type(i) {
 			map->owner->storage_cookie[i] =
@@ -1866,6 +1867,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		      map->owner->jited == fp->jited;
 		/* Note: xdp_has_frags check would go here when available */
 		/* && map->owner->xdp_has_frags == aux->xdp_has_frags; */
+		if (ret &&
+		    map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
+		    map->owner->expected_attach_type != fp->expected_attach_type)
+			ret = false;
 		for_each_cgroup_storage_type(i) {
 			if (!ret)
 				break;

---
base-commit: 0996e0926f6b4d6123e1b94407d726bc9810248e
change-id: 20260910-cve-2025-40123-5-15-292e837b56c4

Best regards,
--  
Miguel Gazquez (Schneider Electric) <miguel.gazquez@bootlin.com>

Re: [PATCH 5.15.y] bpf: Enforce expected_attach_type for tailcall compatibility

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] The new `expected_attach_type` enforcement for `PROG_ARRAY` maps can be completely bypassed using `BPF_PROG_TYPE_EXT` (extension) programs, allowing execution of restricted helpers in the wrong context.

Pre-existing issues:
- [Critical] A logic bug in `__bpf_prog_map_compatible` bypasses the `attach_func_proto` compatibility check for `BPF_PROG_TYPE_EXT` programs, allowing normal programs to tail call into them with incompatible register states.
--

commit e59631235c69f576df8b0685292dedba6977c75e
Author: Daniel Borkmann <daniel@iogearbox.net>
Subject: bpf: Enforce expected_attach_type for tailcall compatibility

This patch updates tailcall map compatibility checks to enforce that the
expected_attach_type of the map owner matches the expected_attach_type of
the program being inserted. This prevents programs with different contextual
restrictions from bypassing verifier constraints via tailcalls.

Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
[ ... ]
> @@ -1866,6 +1867,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
>  		      map->owner->jited == fp->jited;
>  		/* Note: xdp_has_frags check would go here when available */
>  		/* && map->owner->xdp_has_frags == aux->xdp_has_frags; */
> +		if (ret &&
> +		    map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
> +		    map->owner->expected_attach_type != fp->expected_attach_type)
> +			ret = false;

[Severity: High]
Does this new check fully prevent expected_attach_type mismatches when
BPF_PROG_TYPE_EXT programs are involved?

In bpf_check(), the verifier clears env->prog->expected_attach_type to 0
for BPF_PROG_TYPE_EXT programs after verification. If an EXT program uses
a tail call, the PROG_ARRAY map owner is assigned an expected_attach_type
of 0.

If another EXT program with a different target but the same base type
attempts to tail-call into it, both will have their expected_attach_type
set to 0. Because 0 == 0, the check here passes, which seems to allow them
to bypass the boundary intended by this fix.

[Severity: Critical]
This is a pre-existing issue, but I noticed the attach_func_proto mismatch
is also bypassed for EXT programs in this same function.

Earlier in __bpf_prog_map_compatible(), prog_type is determined using the
target's type:

	enum bpf_prog_type prog_type = fp->aux->dst_prog ? 
				       fp->aux->dst_prog->type : fp->type;

Later, the mismatch check relies on this prog_type:

	switch (prog_type) {
	case BPF_PROG_TYPE_TRACING:
	case BPF_PROG_TYPE_LSM:
	case BPF_PROG_TYPE_EXT:
	case BPF_PROG_TYPE_STRUCT_OPS:
		ret = false;
		break;
	default:
		break;
	}

When an EXT program is inserted into a PROG_ARRAY (e.g., a standard XDP
map), prog_type evaluates to the target's type (BPF_PROG_TYPE_XDP). Because
it evaluates to XDP, it hits the default case in the switch statement
instead of the BPF_PROG_TYPE_EXT case. 

Could this bypass the rejection for mismatched function prototypes and allow
a normal program to tail call into the EXT program with incompatible
register states?

>  		for_each_cgroup_storage_type(i) {
>  			if (!ret)
>  				break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910-cve-2025-40123-5-15-v1-1-547774d4a00b@bootlin.com?part=1

Re: [PATCH 5.15.y] bpf: Enforce expected_attach_type for tailcall compatibility

[Sasha Levin]

> [ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
>
> Yinhao et al. recently reported:
>
>   Our fuzzer tool discovered an uninitialized pointer issue in the
>   bpf_prog_test_run_xdp() function within the Linux kernel's BPF
>   subsystem.

Queued for 5.15, thanks.

-- 
Thanks,
Sasha