[PATCH bpf-next v3 4/5] bpf: Bind the inode bpf_real_data_inode() returns to the file

[Justin Suess <utilityemal77@gmail.com>]

bpf_real_data_inode() returns the inode behind the file's dentry
without taking a reference on it: the file keeps the inode alive. The
verifier types the return as trusted for the whole program, so a
program that acquired the file from bpf_get_task_exe_file() can keep
using the inode after bpf_put_file(), when the file's last reference
may have gone and the inode with it.

Mark the file argument __derives_ret so the returned inode lives
exactly as long as the file does.

Fixes: 3f8c65b06faf ("bpf: have bpf_real_data_inode() take a struct file")
Suggested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
 fs/bpf_fs_kfuncs.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c
index 08f0847c4970..8b58379536ca 100644
--- a/fs/bpf_fs_kfuncs.c
+++ b/fs/bpf_fs_kfuncs.c
@@ -480,7 +480,7 @@ __bpf_kfunc int bpf_sock_read_xattr(struct socket *sock, const char *name__str,
 
 /**
  * bpf_real_data_inode - get the real inode hosting a file's data
- * @file: file to resolve
+ * @file__derives_ret: file to resolve, which keeps the returned inode alive
  *
  * Resolve @file to the inode that hosts its data. For a regular file on a
  * union/overlay filesystem this is the underlying (upper or lower) inode that
@@ -491,11 +491,14 @@ __bpf_kfunc int bpf_sock_read_xattr(struct socket *sock, const char *name__str,
  * inode itself is returned; for any file on a non-union filesystem the inode
  * attached to @file is returned.
  *
+ * The returned inode is only valid for as long as the file is: a program
+ * that acquired the file must not use the inode after releasing it.
+ *
  * Return: The inode hosting @file's data, or NULL.
  */
-__bpf_kfunc struct inode *bpf_real_data_inode(struct file *file)
+__bpf_kfunc struct inode *bpf_real_data_inode(struct file *file__derives_ret)
 {
-	return d_real_inode(file_dentry(file));
+	return d_real_inode(file_dentry(file__derives_ret));
 }
 
 __bpf_kfunc_end_defs();
-- 
2.55.0