bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call
authorDave Marchevsky <davemarchevsky@fb.com>
Mon, 3 Apr 2023 20:00:27 +0000 (13:00 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Mon, 3 Apr 2023 21:54:21 +0000 (14:54 -0700)
commitf6a6a5a976288e4d0d94eb1c6c9e983e8e5cdb31
tree3be308f941dc363907dec50b22542c7a0da09457
parent16b7c970cc8192e929dbd5192ccc1867e19d7bda
bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call

bpf_obj_drop_impl has a void return type. In check_kfunc_call, the "else
if" which sets insn_aux->kptr_struct_meta for bpf_obj_drop_impl is
surrounded by a larger if statement which checks btf_type_is_ptr. As a
result:

  * The bpf_obj_drop_impl-specific code will never execute
  * The btf_struct_meta input to bpf_obj_drop is always NULL
  * __bpf_obj_drop_impl will always see a NULL btf_record when called
    from BPF program, and won't call bpf_obj_free_fields
  * program-allocated kptrs which have fields that should be cleaned up
    by bpf_obj_free_fields may instead leak resources

This patch adds a btf_type_is_void branch to the larger if and moves
special handling for bpf_obj_drop_impl there, fixing the issue.

Fixes: ac9f06050a35 ("bpf: Introduce bpf_obj_drop")
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
Link: https://lore.kernel.org/r/20230403200027.2271029-1-davemarchevsky@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c