Skip to content

bpf, rex: fix a NULL deref on program load under SELinux, and a bpf_attr ABI desync with tools/ #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SeungJong-Ha wants to merge 2 commits into
base: rex-linux
Choose a base branch
from
Open

bpf, rex: fix a NULL deref on program load under SELinux, and a bpf_attr ABI desync with tools/ #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f30fc8e
bpf, rex: call security_bpf_prog_load() from the Rex load paths
SeungJong-Ha Aug 25, 2026
ea57186
bpf, rex: sync union bpf_attr into the tools/ uapi header
SeungJong-Ha Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion include/uapi/linux/bpf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1647,7 +1647,7 @@ union bpf_attr {
__aligned_u64 text_syms; /* ptr to text sym info entries */
__aligned_u64 nr_text_syms; /* nr of text sym info entries */
__u32 rustfd; /* file descriptor of Rust Program */
__u32 map_cnt; /* length map reloc array */
__u32 map_cnt; /* length map reloc array */
};
struct {
__aligned_u64 prog_offset; /* offset of prog in base */
Expand Down
8 changes: 8 additions & 0 deletions kernel/bpf/syscall.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3285,6 +3285,10 @@ static int bpf_prog_load_rex(union bpf_attr *attr, bpfptr_t uattr)
if (err < 0)
goto free_prog_sec;

err = security_bpf_prog_load(prog, attr, NULL, uattr.is_kernel);
if (err)
goto free_prog_sec;

prog->no_bpf = 1;

/* This gets the refcnt */
Expand Down Expand Up @@ -3811,6 +3815,10 @@ static int bpf_prog_load_rex_base(union bpf_attr *attr, bpfptr_t uattr)
if (err < 0)
goto free_prog_sec;

err = security_bpf_prog_load(prog, attr, NULL, uattr.is_kernel);
if (err)
goto free_prog_sec;

bpf_get_trace_printk_proto();

filp = fget(attr->rustfd);
Expand Down
18 changes: 18 additions & 0 deletions tools/include/uapi/linux/bpf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1094,6 +1094,7 @@ enum bpf_prog_type {
BPF_PROG_TYPE_SK_LOOKUP,
BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */
BPF_PROG_TYPE_NETFILTER,
BPF_PROG_TYPE_REX_BASE,
__MAX_BPF_PROG_TYPE
};

Expand Down Expand Up @@ -1619,6 +1620,23 @@ union bpf_attr {
__u32 attach_btf_obj_fd;
};
__u32 core_relo_cnt; /* number of bpf_core_relo */
union {
struct {
__aligned_u64 map_offs; /* offsets of map relocs */
__aligned_u64 dyn_relas; /* ptr to dynamic rela info */
__aligned_u64 nr_dyn_relas; /* nr of dyn rela entries */
__aligned_u64 dyn_syms; /* ptr to dyn sym entries */
__aligned_u64 nr_dyn_syms; /* nr of dyn sym entries */
__aligned_u64 text_syms; /* ptr to text sym info entries */
__aligned_u64 nr_text_syms; /* nr of text sym info entries */
__u32 rustfd; /* file descriptor of Rust Program */
__u32 map_cnt; /* length map reloc array */
};
struct {
__aligned_u64 prog_offset; /* offset of prog in base */
__u32 base_prog_fd; /* fd of the base prog */
};
};
__aligned_u64 fd_array; /* array of FDs */
__aligned_u64 core_relos;
__u32 core_relo_rec_size; /* sizeof(struct bpf_core_relo) */
Expand Down