bpf: Fix refcount check in check_struct_ops_btf_id()

The current implementation only checks whether the first argument is
refcounted. Fix this by iterating over all arguments.

Signed-off-by: Keisuke Nishimura <keisuke.nishimura@inria.fr>
Fixes: 38f1e66abd184 ("bpf: Do not allow tail call in strcut_ops program with __ref argument")
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260320130219.63711-1-keisuke.nishimura@inria.fr
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index cd008b146ee526d0b81639952e53cae5de7a554d..88f622125376e77d7f74a79b2bbcbeb898586ba8 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -24959,7 +24959,7 @@ static int check_struct_ops_btf_id(struct bpf_verifier_env *env)
        }
 
        for (i = 0; i < st_ops_desc->arg_info[member_idx].cnt; i++) {
-               if (st_ops_desc->arg_info[member_idx].info->refcounted) {
+               if (st_ops_desc->arg_info[member_idx].info[i].refcounted) {
                        has_refcounted_arg = true;
                        break;
                }