Re: [PATCH bpf-next v3] bpf: Fix stack out-of-bounds write in cgroup link update

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] A multi-line comment violates the mandatory BPF subsystem comment style.
--

--- Patch [1]: [PATCH bpf-next v3] bpf: Fix stack out-of-bounds write in cgroup link update ---
commit 3542a649528edfe00a99f7439585e0f6e14c0cc5
Author: Sanghyun Park <[email protected]>

bpf: Fix stack out-of-bounds write in cgroup link update

This commit validates replacement programs against the link attach type during
cgroup link updates to prevent out-of-bounds writes on the stack. It restricts
replacements between incompatible BPF program types that share the same main
type but have different context or return semantics. A new helper function is
introduced to factor out the capability checks for CGROUP_SKB programs.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6874ba1424af0..dfea337ff25ea 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c

[ ... ]

> @@ -4542,6 +4536,19 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
>  	}
>  }
>  
> +static int bpf_prog_attach_check(const struct bpf_prog *prog,
> +				 enum bpf_attach_type attach_type)
> +{
> +	if (prog->type == BPF_PROG_TYPE_CGROUP_SKB &&
> +	    !bpf_token_capable(prog->aux->token, CAP_NET_ADMIN))
> +		/* cg-skb progs can be loaded by unpriv user.
> +		 * check permissions at attach time.
> +		 */

[Severity: Low]
This isn't a bug, but does this violate the modern BPF multi-line comment
style? The BPF subsystem guidelines prefer having the opening /* on its
own line.

> +		return -EPERM;
> +
> +	return bpf_prog_attach_check_attach_type(prog, attach_type);
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1