Re: [PATCH 2/2] sched_ext: Make scx_bpf_events() read the calling scheduler's counters

[Tejun Heo <tj@kernel.org>]

Hello,

> If a BPF_PROG_TYPE_TRACING or BPF_PROG_TYPE_SYSCALL program is associated
> with a different struct_ops map (like tcp_congestion_ops), the pointer is
> blindly cast to struct sched_ext_ops *.
>
> Since struct sched_ext_ops is much larger than other struct_ops structures,
> reading ops->priv could read memory well past the end of the map allocation
> and cause a kernel panic when the garbage value is dereferenced as a
> struct scx_sched *.

The hole exists but reaching it requires the privileged userspace to
deliberately associate its own tracing or syscall program with a wrong type
of struct_ops map and then call SCX kfuncs from it. Association is an
explicit per-program operation, so this can't happen accidentally. The
right fix is rejecting the association of a program which uses SCX kfuncs
with a non-sched_ext struct_ops map at association time, which the
association path has enough information to do. Will worry about it later.

Thanks.

-- 
tejun