diff --git a/Documentation/bpf/kfuncs.rst b/Documentation/bpf/kfuncs.rst index 329d1510b02a..901c37504217 100644 --- a/Documentation/bpf/kfuncs.rst +++ b/Documentation/bpf/kfuncs.rst @@ -410,9 +410,9 @@ explored states of the program. A pointer to a struct in the arguments of a KF_ACQUIRE kfunc accepts only an object of that type. The same applies to the argument that a KF_RELEASE kfunc releases. For other arguments a kfunc also accepts memory of the program, if the -struct has only scalar members. struct __sk_buff and struct xdp_md never accept -memory. A KF_ACQUIRE kfunc which wants such memory has to pair the pointer with -a __sz argument. +struct has only scalar members. A struct without members, struct __sk_buff and +struct xdp_md never accept memory. A KF_ACQUIRE kfunc which wants such memory +has to pair the pointer with a __sz argument. 2.5.2 KF_RET_NULL flag ---------------------- diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index ac56e7642432..1bf38f3e4819 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -13593,10 +13593,12 @@ static int resolve_func_arg_type(struct bpf_verifier_env *env, /* * A kfunc that takes a projection type (ie. xdp_md) casts it to the * underlying type. So memory of the program cannot stand in for it, - * even if the projection type holds only scalars. + * even if the projection type holds only scalars. A struct without + * members (ie. iou_ctx) is a handle for an object of another type. */ if (btf_is_projection_type(ref_tname) || - !btf_type_is_scalar_struct(env, btf, ref_t)) + !btf_type_is_scalar_struct(env, btf, ref_t) || + !btf_type_vlen(ref_t)) return 0; resolve_ret = btf_resolve_size(btf, ref_t, arg_size);