bpf: Set kptr_struct_meta for node param to list and rbtree insert funcs
authorDave Marchevsky <davemarchevsky@fb.com>
Fri, 2 Jun 2023 02:26:40 +0000 (19:26 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Mon, 5 Jun 2023 20:17:19 +0000 (13:17 -0700)
commit2140a6e3422de22e6ebe77d4d18b6c0c9c425426
treeba001f5522794ab03ffa2db4059ff5d165d0d515
parentd4ae3e587eced73c9b6f82fd8f88606a09ff710c
bpf: Set kptr_struct_meta for node param to list and rbtree insert funcs

In verifier.c, fixup_kfunc_call uses struct bpf_insn_aux_data's
kptr_struct_meta field to pass information about local kptr types to
various helpers and kfuncs at runtime. The recent bpf_refcount series
added a few functions to the set that need this information:

  * bpf_refcount_acquire
    * Needs to know where the refcount field is in order to increment
  * Graph collection insert kfuncs: bpf_rbtree_add, bpf_list_push_{front,back}
    * Were migrated to possibly fail by the bpf_refcount series. If
      insert fails, the input node is bpf_obj_drop'd. bpf_obj_drop needs
      the kptr_struct_meta in order to decr refcount and properly free
      special fields.

Unfortunately the verifier handling of collection insert kfuncs was not
modified to actually populate kptr_struct_meta. Accordingly, when the
node input to those kfuncs is passed to bpf_obj_drop, it is done so
without the information necessary to decr refcount.

This patch fixes the issue by populating kptr_struct_meta for those
kfuncs.

Fixes: d2dcc67df910 ("bpf: Migrate bpf_rbtree_add and bpf_list_push_{front,back} to possibly fail")
Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
Link: https://lore.kernel.org/r/20230602022647.1571784-3-davemarchevsky@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c