Patch "bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call" has been added to the 6.2-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-struct_meta-lookup-for-bpf_obj_free_fields-k.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ae8da802193db32c81fe615ce599018dcbdbdad5
Author: Dave Marchevsky <davemarchevsky@xxxxxx>
Date:   Mon Apr 3 13:00:27 2023 -0700

    bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call
    
    [ Upstream commit f6a6a5a976288e4d0d94eb1c6c9e983e8e5cdb31 ]
    
    bpf_obj_drop_impl has a void return type. In check_kfunc_call, the "else
    if" which sets insn_aux->kptr_struct_meta for bpf_obj_drop_impl is
    surrounded by a larger if statement which checks btf_type_is_ptr. As a
    result:
    
      * The bpf_obj_drop_impl-specific code will never execute
      * The btf_struct_meta input to bpf_obj_drop is always NULL
      * __bpf_obj_drop_impl will always see a NULL btf_record when called
        from BPF program, and won't call bpf_obj_free_fields
      * program-allocated kptrs which have fields that should be cleaned up
        by bpf_obj_free_fields may instead leak resources
    
    This patch adds a btf_type_is_void branch to the larger if and moves
    special handling for bpf_obj_drop_impl there, fixing the issue.
    
    Fixes: ac9f06050a35 ("bpf: Introduce bpf_obj_drop")
    Cc: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
    Signed-off-by: Dave Marchevsky <davemarchevsky@xxxxxx>
    Link: https://lore.kernel.org/r/20230403200027.2271029-1-davemarchevsky@xxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6db3589f0e7cc..1c7dad0e79b92 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9841,10 +9841,6 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
 				insn_aux->obj_new_size = ret_t->size;
 				insn_aux->kptr_struct_meta =
 					btf_find_struct_meta(ret_btf, ret_btf_id);
-			} else if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
-				insn_aux->kptr_struct_meta =
-					btf_find_struct_meta(meta.arg_obj_drop.btf,
-							     meta.arg_obj_drop.btf_id);
 			} else if (meta.func_id == special_kfunc_list[KF_bpf_list_pop_front] ||
 				   meta.func_id == special_kfunc_list[KF_bpf_list_pop_back]) {
 				struct btf_field *field = meta.arg_list_head.field;
@@ -9922,7 +9918,15 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
 		}
 		if (reg_may_point_to_spin_lock(&regs[BPF_REG_0]) && !regs[BPF_REG_0].id)
 			regs[BPF_REG_0].id = ++env->id_gen;
-	} /* else { add_kfunc_call() ensures it is btf_type_is_void(t) } */
+	} else if (btf_type_is_void(t)) {
+		if (meta.btf == btf_vmlinux && btf_id_set_contains(&special_kfunc_set, meta.func_id)) {
+			if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
+				insn_aux->kptr_struct_meta =
+					btf_find_struct_meta(meta.arg_obj_drop.btf,
+							     meta.arg_obj_drop.btf_id);
+			}
+		}
+	}
 
 	nargs = btf_type_vlen(meta.func_proto);
 	args = (const struct btf_param *)(meta.func_proto + 1);