Commit 428dc9fc authored by Tejun Heo's avatar Tejun Heo
Browse files

sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator 



BPF programs may call next() and destroy() on BPF iterators even after new()
returns an error value (e.g. bpf_for_each() macro ignores error returns from
new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized
state after an error return causing bpf_iter_scx_dsq_next() to dereference
garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that
next() and destroy() become noops.

Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Fixes: 650ba21b ("sched_ext: Implement DSQ iterator")
Cc: stable@vger.kernel.org # v6.12+
Acked-by: default avatarAndrea Righi <arighi@nvidia.com>
parent e38be1c7

kernel/sched/ext.c

+6 −0
Original line number Diff line number Diff line
@@ -6827,6 +6827,12 @@ __bpf_kfunc int bpf_iter_scx_dsq_new(struct bpf_iter_scx_dsq *it, u64 dsq_id, 
	BUILD_BUG_ON(__alignof__(struct bpf_iter_scx_dsq_kern) !=

		     __alignof__(struct bpf_iter_scx_dsq));



	/*

	 * next() and destroy() will be called regardless of the return value.

	 * Always clear $kit->dsq.

	 */

	kit->dsq = NULL;



	if (flags & ~__SCX_DSQ_ITER_USER_FLAGS)

		return -EINVAL;