On Thu, 2024-02-01 at 04:21 +0000, Kumar Kartikeya Dwivedi wrote:
[...]
> +int bpf_cleanup_resource_reg(struct bpf_frame_desc_reg_entry *fd, void *ptr)
> +{
Question:
Maybe I missed something in frame descriptor construction process,
but it appears like there is nothing guarding against double cleanup.
E.g. consider a program like below:
r6 = ... PTR_TO_SOCKET ...
r7 = r6
*(u64 *)(r10 - 16) = r6
call bpf_throw()
Would bpf_cleanup_resource_reg() be called for all r6, r7 and fp[-16],
thus executing destructor for the same object multiple times?
> + u64 reg_value = ptr ? *(u64 *)ptr : 0;
> + struct btf_struct_meta *meta;
> + const struct btf_type *t;
> + u32 dtor_id;
> +
> + switch (fd->type) {
> + case PTR_TO_SOCKET:
> + case PTR_TO_TCP_SOCK:
> + case PTR_TO_SOCK_COMMON:
> + if (reg_value)
> + bpf_sk_release_dtor((void *)reg_value);
> + return 0;
[...]
