bpf: Fix a bpf_kptr_xchg() issue with local kptr
authorYonghong Song <yonghong.song@linux.dev>
Tue, 22 Aug 2023 05:00:53 +0000 (22:00 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 22 Aug 2023 16:43:55 +0000 (09:43 -0700)
commitab6c637ad0276e42f8acabcbc64932a6d346dab3
tree949811202c1bf84feed08e2606739abfabd6db19
parentd56518380085d78f179cdc701d791ace4acb1d23
bpf: Fix a bpf_kptr_xchg() issue with local kptr

When reviewing local percpu kptr support, Alexei discovered a bug
wherea bpf_kptr_xchg() may succeed even if the map value kptr type and
locally allocated obj type do not match ([1]). Missed struct btf_id
comparison is the reason for the bug. This patch added such struct btf_id
comparison and will flag verification failure if types do not match.

  [1] https://lore.kernel.org/bpf/20230819002907.io3iphmnuk43xblu@macbook-pro-8.dhcp.thefacebook.com/#t

Reported-by: Alexei Starovoitov <ast@kernel.org>
Fixes: 738c96d5e2e3 ("bpf: Allow local kptrs to be exchanged via bpf_kptr_xchg")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20230822050053.2886960-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c