diff options
| author | Keisuke Nishimura <keisuke.nishimura@inria.fr> | 2026-03-20 16:02:20 +0300 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-03-24 18:50:20 +0300 |
| commit | 25e3e1f1096089a64901ae1faa7b7b13446653db (patch) | |
| tree | 8a370e84dc1a786acb9ca6fce983f4753cd5babc | |
| parent | ad2f7ed0ee91d63792cbe52f2b38325918ae3daa (diff) | |
| download | linux-25e3e1f1096089a64901ae1faa7b7b13446653db.tar.xz | |
bpf: Fix refcount check in check_struct_ops_btf_id()
The current implementation only checks whether the first argument is
refcounted. Fix this by iterating over all arguments.
Signed-off-by: Keisuke Nishimura <keisuke.nishimura@inria.fr>
Fixes: 38f1e66abd184 ("bpf: Do not allow tail call in strcut_ops program with __ref argument")
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260320130219.63711-1-keisuke.nishimura@inria.fr
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
| -rw-r--r-- | kernel/bpf/verifier.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index cd008b146ee5..88f622125376 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -24959,7 +24959,7 @@ static int check_struct_ops_btf_id(struct bpf_verifier_env *env) } for (i = 0; i < st_ops_desc->arg_info[member_idx].cnt; i++) { - if (st_ops_desc->arg_info[member_idx].info->refcounted) { + if (st_ops_desc->arg_info[member_idx].info[i].refcounted) { has_refcounted_arg = true; break; } |