Patch "bpf: Fix global subprog context argument resolution logic" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Fix global subprog context argument resolution logic

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-global-subprog-context-argument-resolution-l.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f73fbd1bb63b940e50efd10a484916c4766c1d4a
Author: Andrii Nakryiko <andrii@xxxxxxxxxx>
Date:   Wed Feb 15 20:59:52 2023 -0800

    bpf: Fix global subprog context argument resolution logic
    
    [ Upstream commit d384dce281ed1b504fae2e279507827638d56fa3 ]
    
    KPROBE program's user-facing context type is defined as typedef
    bpf_user_pt_regs_t. This leads to a problem when trying to passing
    kprobe/uprobe/usdt context argument into global subprog, as kernel
    always strip away mods and typedefs of user-supplied type, but takes
    expected type from bpf_ctx_convert as is, which causes mismatch.
    
    Current way to work around this is to define a fake struct with the same
    name as expected typedef:
    
      struct bpf_user_pt_regs_t {};
    
      __noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... }
    
    This patch fixes the issue by resolving expected type, if it's not
    a struct. It still leaves the above work-around working for backwards
    compatibility.
    
    Fixes: 91cc1a99740e ("bpf: Annotate context types")
    Signed-off-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Stanislav Fomichev <sdf@xxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 0c2fa93bd8d27..1f9369b677fe2 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4468,6 +4468,7 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
 	if (!ctx_struct)
 		/* should not happen */
 		return NULL;
+again:
 	ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_struct->name_off);
 	if (!ctx_tname) {
 		/* should not happen */
@@ -4481,8 +4482,16 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
 	 * int socket_filter_bpf_prog(struct __sk_buff *skb)
 	 * { // no fields of skb are ever used }
 	 */
-	if (strcmp(ctx_tname, tname))
-		return NULL;
+	if (strcmp(ctx_tname, tname)) {
+		/* bpf_user_pt_regs_t is a typedef, so resolve it to
+		 * underlying struct and check name again
+		 */
+		if (!btf_type_is_modifier(ctx_struct))
+			return NULL;
+		while (btf_type_is_modifier(ctx_struct))
+			ctx_struct = btf_type_by_id(btf_vmlinux, ctx_struct->type);
+		goto again;
+	}
 	return ctx_type;
 }