[PATCH bpf-next v3 0/2] bpf: require an owned cpumask for bpf_cpumask_populate()

[Nicholas Dudar <main.kalliope@gmail.com>]

bpf_cpumask_populate() writes its destination with bitmap_copy() but
types it as struct cpumask *, so the verifier accepts a borrowed,
read-only cpumask (for example from scx_bpf_get_online_cpumask()) as a
writable destination. Fix it and add a selftest for coverage.

Changelog:
----------
v2 -> v3 (v1/v2 were a private report to security@kernel.org)

 * Split the fix and selftest into separate patches.
 * Target bpf-next instead of bpf.

Nicholas Dudar (2):
  bpf: Require a BPF cpumask for bpf_cpumask_populate()
  selftests/bpf: test bpf_cpumask_populate() rejects a borrowed cpumask

 kernel/bpf/cpumask.c                          |  6 ++---
 tools/sched_ext/include/scx/compat.bpf.h      |  2 +-
 .../selftests/bpf/progs/cpumask_common.h      |  2 +-
 .../selftests/bpf/progs/cpumask_failure.c     | 23 +++++++++++++++++--
 .../selftests/bpf/progs/cpumask_success.c     |  6 ++---
 5 files changed, 29 insertions(+), 10 deletions(-)


base-commit: 36ffa86c42f91c8a57071e024afc4ffb51a8958f
-- 
2.34.1