5 files changed, 63 insertions, 8 deletions

diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 023101c6f0d7..2d61e5e8c863 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -590,7 +590,7 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
                 goto out;
 
         error = BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, &count,
-                                           &new_buf);
+                                           ppos, &new_buf);
         if (error)
                 goto out;
 
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index 1e97271f9a10..cb3c6b3b89c8 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h
@@ -114,7 +114,8 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
 int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
                                    struct ctl_table *table, int write,
                                    void __user *buf, size_t *pcount,
-                                   void **new_buf, enum bpf_attach_type type);
+                                   loff_t *ppos, void **new_buf,
+                                   enum bpf_attach_type type);
 
 static inline enum bpf_cgroup_storage_type cgroup_storage_type(
         struct bpf_map *map)
@@ -262,12 +263,12 @@ int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key,
 })
 
 
-#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, nbuf)       \
+#define BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, count, pos, nbuf)  \
 ({                                                                             \
         int __ret = 0;                                                         \
         if (cgroup_bpf_enabled)                                                \
                 __ret = __cgroup_bpf_run_filter_sysctl(head, table, write,     \
-                                                       buf, count, nbuf,       \
+                                                       buf, count, pos, nbuf,  \
                                                        BPF_CGROUP_SYSCTL);     \
         __ret;                                                                 \
 })
@@ -340,7 +341,7 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
 #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
-#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,nbuf) ({ 0; })
+#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos,nbuf) ({ 0; })
 
 #define for_each_cgroup_storage_type(stype) for (; false; )
 
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a23653f9460c..fb0edad75971 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1188,6 +1188,9 @@ struct bpf_sysctl_kern {
         size_t new_len;
         int new_updated;
         int write;
+        loff_t *ppos;
+        /* Temporary "register" for indirect stores to ppos. */
+        u64 tmp_reg;
 };
 
 #endif /* __LINUX_FILTER_H__ */
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 547b8258d731..89976de909af 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3391,6 +3391,9 @@ struct bpf_sysctl {
         __u32   write;          /* Sysctl is being read (= 0) or written (= 1).
                                  * Allows 1,2,4-byte read, but no write.
                                  */
+        __u32   file_pos;       /* Sysctl file position to read from, write to.
+                                 * Allows 1,2,4-byte read an 4-byte write.
+                                 */
 };
 
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index ba4e21986760..b2adf22139b3 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -782,6 +782,9 @@ const struct bpf_verifier_ops cg_dev_verifier_ops = {
  * @pcount: value-result argument: value is size of buffer pointed to by @buf,
  *      result is size of @new_buf if program set new value, initial value
  *      otherwise
+ * @ppos: value-result argument: value is position at which read from or write
+ *      to sysctl is happening, result is new position if program overrode it,
+ *      initial value otherwise
  * @new_buf: pointer to pointer to new buffer that will be allocated if program
  *      overrides new value provided by user space on sysctl write
  *      NOTE: it's caller responsibility to free *new_buf if it was set
@@ -796,12 +799,14 @@ const struct bpf_verifier_ops cg_dev_verifier_ops = {
 int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head,
                                    struct ctl_table *table, int write,
                                    void __user *buf, size_t *pcount,
-                                   void **new_buf, enum bpf_attach_type type)
+                                   loff_t *ppos, void **new_buf,
+                                   enum bpf_attach_type type)
 {
         struct bpf_sysctl_kern ctx = {
                 .head = head,
                 .table = table,
                 .write = write,
+                .ppos = ppos,
                 .cur_val = NULL,
                 .cur_len = PAGE_SIZE,
                 .new_val = NULL,
@@ -1030,14 +1035,22 @@ static bool sysctl_is_valid_access(int off, int size, enum bpf_access_type type,
 {
         const int size_default = sizeof(__u32);
 
-        if (off < 0 || off + size > sizeof(struct bpf_sysctl) ||
-            off % size || type != BPF_READ)
+        if (off < 0 || off + size > sizeof(struct bpf_sysctl) || off % size)
                 return false;
 
         switch (off) {
         case offsetof(struct bpf_sysctl, write):
+                if (type != BPF_READ)
+                        return false;
                 bpf_ctx_record_field_size(info, size_default);
                 return bpf_ctx_narrow_access_ok(off, size, size_default);
+        case offsetof(struct bpf_sysctl, file_pos):
+                if (type == BPF_READ) {
+                        bpf_ctx_record_field_size(info, size_default);
+                        return bpf_ctx_narrow_access_ok(off, size, size_default);
+                } else {
+                        return size == size_default;
+                }
         default:
                 return false;
         }
@@ -1059,6 +1072,41 @@ static u32 sysctl_convert_ctx_access(enum bpf_access_type type,
                                                     write),
                                        target_size));
                 break;
+        case offsetof(struct bpf_sysctl, file_pos):
+                /* ppos is a pointer so it should be accessed via indirect
+                 * loads and stores. Also for stores additional temporary
+                 * register is used since neither src_reg nor dst_reg can be
+                 * overridden.
+                 */
+                if (type == BPF_WRITE) {
+                        int treg = BPF_REG_9;
+
+                        if (si->src_reg == treg || si->dst_reg == treg)
+                                --treg;
+                        if (si->src_reg == treg || si->dst_reg == treg)
+                                --treg;
+                        *insn++ = BPF_STX_MEM(
+                                BPF_DW, si->dst_reg, treg,
+                                offsetof(struct bpf_sysctl_kern, tmp_reg));
+                        *insn++ = BPF_LDX_MEM(
+                                BPF_FIELD_SIZEOF(struct bpf_sysctl_kern, ppos),
+                                treg, si->dst_reg,
+                                offsetof(struct bpf_sysctl_kern, ppos));
+                        *insn++ = BPF_STX_MEM(
+                                BPF_SIZEOF(u32), treg, si->src_reg, 0);
+                        *insn++ = BPF_LDX_MEM(
+                                BPF_DW, treg, si->dst_reg,
+                                offsetof(struct bpf_sysctl_kern, tmp_reg));
+                } else {
+                        *insn++ = BPF_LDX_MEM(
+                                BPF_FIELD_SIZEOF(struct bpf_sysctl_kern, ppos),
+                                si->dst_reg, si->src_reg,
+                                offsetof(struct bpf_sysctl_kern, ppos));
+                        *insn++ = BPF_LDX_MEM(
+                                BPF_SIZE(si->code), si->dst_reg, si->dst_reg, 0);
+                }
+                *target_size = sizeof(u32);
+                break;
         }
 
         return insn - insn_buf;