[PATCH bpf-next 4/8] bpf: Disallow !call_session_cookie progs tail-calling call_session_cookie progs

[Leon Hwang <leon.hwang@linux.dev>]

bpf_session_cookie() depends on consistent session metadata stored on
stack for fsession programs. Mixing fsession programs that do and do not
rely on these helpers in tail calls can violate that runtime contract.

Disallow the combination of !call_session_cookie progs and
call_session_cookie progs in __bpf_prog_map_compatible() to address the
issue.

Fixes: eeee4239dbb1 ("bpf: support fsession for bpf_session_cookie")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 include/linux/bpf.h | 3 ++-
 kernel/bpf/core.c   | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 65793fd146c5..c74db70f9be1 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -289,7 +289,8 @@ struct bpf_map_owner {
 	    xdp_has_frags:1,
 	    sleepable:1,
 	    kprobe_write_ctx:1,
-	    call_get_func_ip:1;
+	    call_get_func_ip:1,
+	    call_session_cookie:1;
 	u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
 	const struct btf_type *attach_func_proto;
 	enum bpf_attach_type expected_attach_type;
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 01fce3fba0be..904a8dbfd56f 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2404,6 +2404,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		map->owner->sleepable = fp->sleepable;
 		map->owner->kprobe_write_ctx = aux->kprobe_write_ctx;
 		map->owner->call_get_func_ip = fp->call_get_func_ip;
+		map->owner->call_session_cookie = fp->call_session_cookie;
 		map->owner->expected_attach_type = fp->expected_attach_type;
 		map->owner->attach_func_proto = aux->attach_func_proto;
 		for_each_cgroup_storage_type(i) {
@@ -2422,6 +2423,9 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		if (ret && (!map->owner->call_get_func_ip && fp->call_get_func_ip &&
 			    prog_type == BPF_PROG_TYPE_TRACING))
 			ret = false;
+		if (ret && (!map->owner->call_session_cookie && fp->call_session_cookie &&
+			    prog_type == BPF_PROG_TYPE_TRACING))
+			ret = false;
 		if (ret &&
 		    map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
 		    map->owner->expected_attach_type != fp->expected_attach_type)
-- 
2.52.0