[PATCH bpf-next v2] bpf, lsm: Fix cgroup shim selection for socket hooks

[Andrea Parri <parri.andrea@gmail.com>]

bpf_lsm_find_cgroup_shim() picks the shim that runs a BPF_LSM_CGROUP
program from the first argument of the attached hook. It compares
args[0].type, the BTF id of the argument's pointer type, against
btf_sock_ids[], which holds the struct ids of struct socket and struct
sock. A pointer id is never equal to a struct id, so neither branch is
taken and every cgroup LSM program runs through
__cgroup_bpf_run_lsm_current().

Socket and sock hooks therefore run against task_dfl_cgroup(current)
instead of the socket's cgroup. When a socket is used from a cgroup other
than the one that created it, the caller's cgroup policy is applied instead
of the socket's, and __cgroup_bpf_run_lsm_socket() and
__cgroup_bpf_run_lsm_sock() are dead code.

Resolve the argument's pointee with btf_type_resolve_ptr() and compare that
id against btf_sock_ids[].

Two socket hooks are not always called with a usable socket:
ip_cmsg_recv_security() passes a NULL socket to socket_getpeersec_dgram,
and sock_create_lite() calls socket_post_create before sock->sk is set.
Add both to bpf_lsm_current_hooks, so that their cgroup does not depend on
the caller.

socket_post_create is unchanged when called from __sock_create(), where
the current task allocates the sk and gives it its cgroup.
socket_getpeersec_dgram keeps the current cgroup, as today. The other
socket hooks always get a socket with an sk, and the sock hooks a non-NULL
sk.

Existing BPF_LSM_CGROUP users will see a behavior change. The other socket
and sock hooks now run the socket's cgroup programs, as described in
commit 69fd337a975c ("bpf: per-cgroup lsm flavor"). Hooks that can run in
softirq, such as socket_sock_rcv_skb, inet_conn_request and sk_getsecid,
no longer depend on which task was interrupted.

The bug was found with the help of an LLM.

Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
---
v2:
- Add socket_post_create and socket_getpeersec_dgram to
  bpf_lsm_current_hooks instead of falling back to the current cgroup in
  __cgroup_bpf_run_lsm_socket() (Alexei)
- Drop Fixes: and Cc: stable, target bpf-next (Alexei)

v1: https://lore.kernel.org/bpf/20261102152913.366237-1-parri.andrea@gmail.com/

 kernel/bpf/bpf_lsm.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index f58dce888ff4a..485e8fe8524c8 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -66,6 +66,10 @@ BTF_SET_START(bpf_lsm_current_hooks)
 #ifdef CONFIG_SECURITY_NETWORK
 BTF_ID(func, bpf_lsm_sk_alloc_security)
 BTF_ID(func, bpf_lsm_sk_free_security)
+/* sock->sk is NULL in sock_create_lite() */
+BTF_ID(func, bpf_lsm_socket_post_create)
+/* sock is NULL in ip_cmsg_recv_security() */
+BTF_ID(func, bpf_lsm_socket_getpeersec_dgram)
 #endif
 BTF_SET_END(bpf_lsm_current_hooks)
 
@@ -95,6 +99,7 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
 			     bpf_func_t *bpf_func)
 {
 	const struct btf_param *args __maybe_unused;
+	u32 id __maybe_unused = 0;
 
 	if (btf_type_vlen(prog->aux->attach_func_proto) < 1 ||
 	    btf_id_set_contains(&bpf_lsm_current_hooks,
@@ -105,10 +110,12 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
 
 #ifdef CONFIG_NET
 	args = btf_params(prog->aux->attach_func_proto);
+	/* args[0].type is the id of the pointer. btf_sock_ids[] has structs. */
+	btf_type_resolve_ptr(prog->aux->attach_btf, args[0].type, &id);
 
-	if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCKET])
+	if (id == btf_sock_ids[BTF_SOCK_TYPE_SOCKET])
 		*bpf_func = __cgroup_bpf_run_lsm_socket;
-	else if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCK])
+	else if (id == btf_sock_ids[BTF_SOCK_TYPE_SOCK])
 		*bpf_func = __cgroup_bpf_run_lsm_sock;
 	else
 #endif
-- 
2.53.0