Yonghong Song <yhs@xxxxxxxx> writes:
> On 12/7/22 4:35 PM, Toke Høiland-Jørgensen wrote:
>> The bpf_prog_map_compatible() check makes sure that BPF program types are
>> not mixed inside BPF map types that can contain programs (tail call maps,
>> cpumaps and devmaps). It does this by setting the fields of the map->owner
>> struct to the values of the first program being checked against, and
>> rejecting any subsequent programs if the values don't match.
>>
>> One of the values being set in the map owner struct is the program type,
>> and since the code did not resolve the prog type for fext programs, the map
>> owner type would be set to PROG_TYPE_EXT and subsequent loading of programs
>> of the target type into the map would fail.
>>
>> This bug is seen in particular for XDP programs that are loaded as
>> PROG_TYPE_EXT using libxdp; these cannot insert programs into devmaps and
>> cpumaps because the check fails as described above.
>>
>> Fix the bug by resolving the fext program type to its target program type
>> as elsewhere in the verifier. This requires constifying the parameter of
>> resolve_prog_type() to avoid a compiler warning from the new call site.
>>
>> Fixes: f45d5b6ce2e8 ("bpf: generalise tail call map compatibility check")
>> Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
>
> Could you construct a test case for this problem?
Sure, will add a selftest and send a v2.
-Toke
