diff options
| author | Tejun Heo <tj@kernel.org> | 2025-05-06 00:30:39 +0300 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2025-05-07 19:24:07 +0300 |
| commit | 428dc9fc0873989d73918d4a9cc22745b7bbc799 (patch) | |
| tree | 8102669845543340f2340f839978639d572069fb | |
| parent | e38be1c7647c8c78304ce6d931b3b654e27948b3 (diff) | |
| download | linux-428dc9fc0873989d73918d4a9cc22745b7bbc799.tar.xz | |
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
BPF programs may call next() and destroy() on BPF iterators even after new()
returns an error value (e.g. bpf_for_each() macro ignores error returns from
new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized
state after an error return causing bpf_iter_scx_dsq_next() to dereference
garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that
next() and destroy() become noops.
Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: 650ba21b131e ("sched_ext: Implement DSQ iterator")
Cc: stable@vger.kernel.org # v6.12+
Acked-by: Andrea Righi <arighi@nvidia.com>
| -rw-r--r-- | kernel/sched/ext.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c index 4e37b40ce280..f5133249fd4d 100644 --- a/kernel/sched/ext.c +++ b/kernel/sched/ext.c @@ -6827,6 +6827,12 @@ __bpf_kfunc int bpf_iter_scx_dsq_new(struct bpf_iter_scx_dsq *it, u64 dsq_id, BUILD_BUG_ON(__alignof__(struct bpf_iter_scx_dsq_kern) != __alignof__(struct bpf_iter_scx_dsq)); + /* + * next() and destroy() will be called regardless of the return value. + * Always clear $kit->dsq. + */ + kit->dsq = NULL; + if (flags & ~__SCX_DSQ_ITER_USER_FLAGS) return -EINVAL; |