| From 1c0b35735d11c241f3f67b3883cb51addc81ca6c Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 22 Sep 2021 12:11:52 +0100 |
| Subject: bpf: Exempt CAP_BPF from checks against bpf_jit_limit |
| |
| From: Lorenz Bauer <lmb@cloudflare.com> |
| |
| [ Upstream commit 8a98ae12fbefdb583a7696de719a1d57e5e940a2 ] |
| |
| When introducing CAP_BPF, bpf_jit_charge_modmem() was not changed to treat |
| programs with CAP_BPF as privileged for the purpose of JIT memory allocation. |
| This means that a program without CAP_BPF can block a program with CAP_BPF |
| from loading a program. |
| |
| Fix this by checking bpf_capable() in bpf_jit_charge_modmem(). |
| |
| Fixes: 2c78ee898d8f ("bpf: Implement CAP_BPF") |
| Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> |
| Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> |
| Link: https://lore.kernel.org/bpf/20210922111153.19843-1-lmb@cloudflare.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| kernel/bpf/core.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c |
| index d12efb2550d3..2e4a658d65d6 100644 |
| --- a/kernel/bpf/core.c |
| +++ b/kernel/bpf/core.c |
| @@ -831,7 +831,7 @@ int bpf_jit_charge_modmem(u32 pages) |
| { |
| if (atomic_long_add_return(pages, &bpf_jit_current) > |
| (bpf_jit_limit >> PAGE_SHIFT)) { |
| - if (!capable(CAP_SYS_ADMIN)) { |
| + if (!bpf_capable()) { |
| atomic_long_sub(pages, &bpf_jit_current); |
| return -EPERM; |
| } |
| -- |
| 2.33.0 |
| |
