1 files changed, 30 insertions, 13 deletions

diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 6424ce0e4969..66f00a2b27f4 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -39,6 +39,7 @@
 #include <linux/workqueue.h>
 #include <linux/list.h>
 #include <net/strparser.h>
+#include <net/tcp.h>
 
 struct bpf_stab {
         struct bpf_map map;
@@ -92,6 +93,14 @@ static inline struct smap_psock *smap_psock_sk(const struct sock *sk)
         return rcu_dereference_sk_user_data(sk);
 }
 
+/* compute the linear packet data range [data, data_end) for skb when
+ * sk_skb type programs are in use.
+ */
+static inline void bpf_compute_data_end_sk_skb(struct sk_buff *skb)
+{
+        TCP_SKB_CB(skb)->bpf.data_end = skb->data + skb_headlen(skb);
+}
+
 static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
 {
         struct bpf_prog *prog = READ_ONCE(psock->bpf_verdict);
@@ -101,12 +110,20 @@ static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
                 return SK_DROP;
 
         skb_orphan(skb);
+        /* We need to ensure that BPF metadata for maps is also cleared
+         * when we orphan the skb so that we don't have the possibility
+         * to reference a stale map.
+         */
+        TCP_SKB_CB(skb)->bpf.map = NULL;
         skb->sk = psock->sock;
-        bpf_compute_data_end(skb);
+        bpf_compute_data_end_sk_skb(skb);
+        preempt_disable();
         rc = (*prog->bpf_func)(skb, prog->insnsi);
+        preempt_enable();
         skb->sk = NULL;
 
-        return rc;
+        return rc == SK_PASS ?
+                (TCP_SKB_CB(skb)->bpf.map ? SK_REDIRECT : SK_PASS) : SK_DROP;
 }
 
 static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
@@ -114,17 +131,10 @@ static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
         struct sock *sk;
         int rc;
 
-        /* Because we use per cpu values to feed input from sock redirect
-         * in BPF program to do_sk_redirect_map() call we need to ensure we
-         * are not preempted. RCU read lock is not sufficient in this case
-         * with CONFIG_PREEMPT_RCU enabled so we must be explicit here.
-         */
-        preempt_disable();
         rc = smap_verdict_func(psock, skb);
         switch (rc) {
         case SK_REDIRECT:
-                sk = do_sk_redirect_map();
-                preempt_enable();
+                sk = do_sk_redirect_map(skb);
                 if (likely(sk)) {
                         struct smap_psock *peer = smap_psock_sk(sk);
 
@@ -141,8 +151,6 @@ static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
         /* Fall through and free skb otherwise */
         case SK_DROP:
         default:
-                if (rc != SK_REDIRECT)
-                        preempt_enable();
                 kfree_skb(skb);
         }
 }
@@ -369,7 +377,7 @@ static int smap_parse_func_strparser(struct strparser *strp,
          * any socket yet.
          */
         skb->sk = psock->sock;
-        bpf_compute_data_end(skb);
+        bpf_compute_data_end_sk_skb(skb);
         rc = (*prog->bpf_func)(skb, prog->insnsi);
         skb->sk = NULL;
         rcu_read_unlock();
@@ -487,6 +495,9 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
         int err = -EINVAL;
         u64 cost;
 
+        if (!capable(CAP_NET_ADMIN))
+                return ERR_PTR(-EPERM);
+
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 4 ||
             attr->value_size != 4 || attr->map_flags & ~BPF_F_NUMA_NODE)
@@ -840,6 +851,12 @@ static int sock_map_update_elem(struct bpf_map *map,
                 return -EINVAL;
         }
 
+        if (skops.sk->sk_type != SOCK_STREAM ||
+            skops.sk->sk_protocol != IPPROTO_TCP) {
+                fput(socket->file);
+                return -EOPNOTSUPP;
+        }
+
         err = sock_map_ctx_update_elem(&skops, map, key, flags);
         fput(socket->file);
         return err;