[PATCH bpf-next 1/8] bpf: improve ksock_kfunc_set LSM recursion filter

[Mahe Tardy <mahe.tardy@gmail.com>]

Improves '7ae4eb14c5f9 ("bpf: Add ksock kfuncs")' verifier filter to
avoid recursion from calling bpf_ksock_send() from the
security_socket_sendmsg() LSM hooks. The filter was unnecessarily
restrictive, this makes sure only bpf_ksock_send() is forbidden and not
the bpf_ksock_acquire() and bpf_ksock_release() kfuncs that are part of
the same set but are safe to be called in that context.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
 net/core/bpf_ksock.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/core/bpf_ksock.c b/net/core/bpf_ksock.c
index 48a2e2327ace..6c508c7a0adc 100644
--- a/net/core/bpf_ksock.c
+++ b/net/core/bpf_ksock.c
@@ -264,6 +264,7 @@ BTF_ID(func, bpf_lsm_socket_sendmsg)
 #else
 BTF_ID_UNUSED
 #endif
+BTF_ID_LIST_SINGLE(bpf_ksock_send_id, func, bpf_ksock_send)
 #endif

 static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
@@ -275,9 +276,13 @@ static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
 		return 0;

 #ifdef CONFIG_BPF_LSM
-	if (prog->type == BPF_PROG_TYPE_LSM &&
-	    prog->aux->attach_btf_id != bpf_lsm_socket_sendmsg_id[0])
+	if (prog->type == BPF_PROG_TYPE_LSM) {
+		if (prog->aux->attach_btf_id == bpf_lsm_socket_sendmsg_id[0] &&
+		    kfunc_id == bpf_ksock_send_id[0])
+			return -EACCES;
+
 		return 0;
+	}
 #endif

 	return -EACCES;
--
2.43.0