bpf_jit_subprogs() copies various fields from the main program's aux to each subprogram's aux, but omits the BPF token. This causes bpf_prog_kallsyms_add() to fail for subprograms loaded via BPF token, as bpf_token_capable() falls back to capable() in init_user_ns when token is NULL. Copy prog->aux->token to func[i]->aux->token so that subprograms inherit the same capability delegation as the main program.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -1110,6 +1110,7 @@ int bpf_jit_subprogs(struct bpf_verifier_env *env) · 1109 unmodified lines | |||
| 1110 | func[i]->aux->exception_cb = env->subprog_info[i].is_exception_cb; | 1110 | func[i]->aux->exception_cb = env->subprog_info[i].is_exception_cb; |
| 1111 | func[i]->aux->changes_pkt_data = env->subprog_info[i].changes_pkt_data; | 1111 | func[i]->aux->changes_pkt_data = env->subprog_info[i].changes_pkt_data; |
| 1112 | func[i]->aux->might_sleep = env->subprog_info[i].might_sleep; | 1112 | func[i]->aux->might_sleep = env->subprog_info[i].might_sleep; |
| 1113 | func[i]->aux->token = prog->aux->token; | ||
| 1113 | if (!i) | 1114 | if (!i) |
| 1114 | func[i]->aux->exception_boundary = env->seen_exception; | 1115 | func[i]->aux->exception_boundary = env->seen_exception; |
| 1115 | 1116 | ||