bpf: Fix error checks against bpf_get_btf_vmlinux().

In bpf_struct_ops_map_alloc, it needs to check for NULL in the returned
pointer of bpf_get_btf_vmlinux() when CONFIG_DEBUG_INFO_BTF is not set.
ENOTSUPP is used to preserve the same behavior before the
struct_ops kmod support.

In the function check_struct_ops_btf_id(), instead of redoing the
bpf_get_btf_vmlinux() that has already been done in syscall.c, the fix
here is to check for prog->aux->attach_btf_id.
BPF_PROG_TYPE_STRUCT_OPS must require attach_btf_id and syscall.c
guarantees a valid attach_btf as long as attach_btf_id is set.
When attach_btf_id is not set, this patch returns -ENOTSUPP
because it is what the selftest in test_libbpf_probe_prog_types()
and libbpf_probes.c are expecting for feature probing purpose.

Changes from v1:

 - Remove an unnecessary NULL check in check_struct_ops_btf_id()

Reported-by: syzbot+88f0aafe5f950d7489d7@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/00000000000040d68a060fc8db8c@google.com/
Reported-by: syzbot+1336f3d4b10bcda75b89@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/00000000000026353b060fc21c07@google.com/
Fixes: fcc2c1fb0651 ("bpf: pass attached BTF to the bpf_struct_ops subsystem")
Signed-off-by: Kui-Feng Lee <thinker.li@gmail.com>
Link: https://lore.kernel.org/r/20240126023113.1379504-1-thinker.li@gmail.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c
index defc052e462260852928aaf63f683c9a4c637058..0decd862dfe024768b97edc201234aa51e4d7466 100644 (file)
--- a/kernel/bpf/bpf_struct_ops.c
+++ b/kernel/bpf/bpf_struct_ops.c
@@ -669,6 +669,8 @@ static struct bpf_map *bpf_struct_ops_map_alloc(union bpf_attr *attr)
                btf = bpf_get_btf_vmlinux();
                if (IS_ERR(btf))
                        return ERR_CAST(btf);
+               if (!btf)
+                       return ERR_PTR(-ENOTSUPP);
        }
 
        st_ops_desc = bpf_struct_ops_find_value(btf, attr->btf_vmlinux_value_type_id);

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fe833e831cb64c82c3263ca57618243189cf88fe..c5d68a9d8acc1da1a9988574a032ae7426a533a5 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -20298,7 +20298,10 @@ static int check_struct_ops_btf_id(struct bpf_verifier_env *env)
                return -EINVAL;
        }
 
-       btf = prog->aux->attach_btf ?: bpf_get_btf_vmlinux();
+       if (!prog->aux->attach_btf_id)
+               return -ENOTSUPP;
+
+       btf = prog->aux->attach_btf;
        if (btf_is_module(btf)) {
                /* Make sure st_ops is valid through the lifetime of env */
                env->attach_btf_mod = btf_try_get_module(btf);