[lvc-project] [PATCH 6.12 v2 5/5] bpf, btf: Enforce destructor kfunc type with CFI

[Dmitry Antipov]

From: Sami Tolvanen <samitolvanen at google.com>

commit 99fde4d0626176d03cea35c64a063df73816e64d upstream.

Ensure that registered destructor kfuncs have the same type
as btf_dtor_kfunc_t to avoid a kernel panic on systems with
CONFIG_CFI enabled.

Signed-off-by: Sami Tolvanen <samitolvanen at google.com>
Acked-by: Yonghong Song <yonghong.song at linux.dev>
Link: https://lore.kernel.org/r/20260110082548.113748-10-samitolvanen@google.com
Signed-off-by: Alexei Starovoitov <ast at kernel.org>
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 kernel/bpf/btf.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 5f3b1162208b..b38bdf282991 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -8745,6 +8745,13 @@ static int btf_check_dtor_kfuncs(struct btf *btf, const struct btf_id_dtor_kfunc
 		 */
 		if (!t || !btf_type_is_ptr(t))
 			return -EINVAL;
+
+		if (IS_ENABLED(CONFIG_CFI_CLANG)) {
+			/* Ensure the destructor kfunc type matches btf_dtor_kfunc_t */
+			t = btf_type_by_id(btf, t->type);
+			if (!btf_type_is_void(t))
+				return -EINVAL;
+		}
 	}
 	return 0;
 }
-- 
2.56.0