support expected_attach_type bpf_attr field#91
Conversation
fuhry
force-pushed
the
add-expected-attach-type
branch
from
60a4f11 to
2d1f9c6
Compare
| type AttachType int | ||
|
|
||
| const ( | ||
| AttachTypeCgroupInetIngress AttachType = iota |
There was a problem hiding this comment.
Is there any way to automatically validate that these are in sync with the values in the kernel header file?
This "just having them straight-up hardcoded here" model seems super risky with an off-by-one error making all subsequent enum values incorrect.
(Though also only the first one is actually used, so alternative question, why are these even here?)
There was a problem hiding this comment.
This "just having them straight-up hardcoded here" model seems super risky with an off-by-one error making all subsequent enum values incorrect.
A lot of binary compatibility would break if the enum in bpf.h was to have any members deleted or inserted before the end, so I'm not particularly concerned about this happening. For this PR, I'll add a "keep in sync with" comment. I'll open a separate PR to //go:generate the AttachType and ProgramType enums in Go from the system's bpf.h file.
(Though also only the first one is actually used, so alternative question, why are these even here?)
AttachTypeXdp is referenced at program_xdp.go:82.
The [expected_attach_type](https://elixir.bootlin.com/linux/v6.12.94/source/include/uapi/linux/bpf.h#L1548) struct field was added quite a while ago but was not enforced on tailcalls until torvalds/linux@4540aed (CVE-2025-40123). On hosts with this patch applied, `bpf_map_update_elem` fails with `-EINVAL` when attempting to update a prog array map entry to a program with a non-matching `expected_attach_type`. Add expected_attach_type arg to cgo API and pass via `bpf_attr`. Due to [bpf_check_uarg_tail_zero](https://github.com/torvalds/linux/blob/f31c00c377ccf07c85442712f7c940a855cb3371/kernel/bpf/syscall.c#L83-L113), automatically retry if program load fails with non-zero expected attach type. libbpf equivalent: [bpf_program__set_expected_attach_type](https://docs.ebpf.io/ebpf-library/libbpf/userspace/bpf_program__set_expected_attach_type/)
fuhry
force-pushed
the
add-expected-attach-type
branch
from
2d1f9c6 to
3935b1e
Compare
2 participants
The expected_attach_type struct field was added quite a while ago but was not enforced on tailcalls until torvalds/linux@4540aed (CVE-2025-40123). On hosts with this patch applied,
bpf_map_update_elemfails with-EINVALwhen attempting to update a prog array map entry to a program with a non-matchingexpected_attach_type.Add expected_attach_type arg to cgo API and pass via
bpf_attr. Due to bpf_check_uarg_tail_zero, automatically retry if program load fails with non-zero expected attach type.libbpf equivalent: bpf_program__set_expected_attach_type