[PATCH bpf-next v3 01/15] bpf: Compute the program digest before resolving the fd_array

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

An exclusive map is bound to the digest of its program, which
check_map_prog_compatibility() compares against prog->digest when the
map is added to the program. For a map an insn refers to that happens
from check_and_resolve_insns(), which computed the digest first. For a
map bound through a continuous fd_array it happens in
process_fd_array(), which runs earlier, so for an unsigned program the
comparison saw a zeroed digest and the load failed with -EACCES,
"program's hash doesn't match map's excl_prog_hash", for the very
program the map is exclusive to. A signed program computed the digest
before process_fd_array() already, as the signature is verified over
the insns and the maps the array binds.

Compute the digest there for every program and drop the later call. The
digest, and the tag derived from it, then cover the insns as submitted
for every program, before the CO-RE relocations the kernel applies, as
they did for a signed program and as the hash libbpf computes for an
exclusive map does.

Fixes: baefdbdf6812 ("bpf: Implement exclusive map creation")
Cc: KP Singh <kpsingh@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 kernel/bpf/verifier.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ec136cf377c1..f143b1b18b5c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -21041,10 +21041,6 @@ static int check_and_resolve_insns(struct bpf_verifier_env *env)
 	int insn_cnt = env->prog->len;
 	int i, err;
 
-	err = bpf_prog_calc_tag(env->prog);
-	if (err)
-		return err;
-
 	for (i = 0; i < insn_cnt; i++, insn++) {
 		if (insn->dst_reg >= MAX_BPF_REG &&
 		    !is_stack_arg_st(insn) && !is_stack_arg_stx(insn)) {
@@ -23307,11 +23303,15 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
 		ret = -EINVAL;
 		goto err_prep;
 	}
-	if (env->signature) {
-		ret = bpf_prog_calc_tag(env->prog);
-		if (ret < 0)
-			goto err_prep;
-	}
+	/*
+	 * The digest covers the insns as submitted and is needed before the
+	 * fd_array is resolved: an exclusive map bound through it is checked
+	 * against the digest of the program, and a signature is verified over
+	 * the insns and the maps the array binds.
+	 */
+	ret = bpf_prog_calc_tag(env->prog);
+	if (ret < 0)
+		goto err_prep;
 
 	ret = process_fd_array(env, attr, uattr);
 	if (ret)
-- 
2.53.0-Meta