bpf: Make sure all tail call callers use cgroup storage if the owner does

Mitigate a possible NULL pointer dereference in bpf_get_local_storage()
by requiring all callers to use cgroup storage if the owner does.

Cgroup storage is allocated lazily when attaching a cgroup bpf program.
With tail call, it is possible for a callee BPF program to see a NULL
storage pointer if the caller prorgam does not use cgroup storage.

Reported-by: Yinhao Hu <[email protected]>
Reported-by: Kaiyan Mei <[email protected]>
Reported-by: Dongliang Mu <[email protected]>
Closes: https://lore.kernel.org/bpf/[email protected]/
Signed-off-by: Amery Hung <[email protected]>

Author: ameryhung

kernel/bpf/core.c

@@ -2403,8 +2403,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 				break;
 			cookie = aux->cgroup_storage[i] ?
 				 aux->cgroup_storage[i]->cookie : 0;
-			ret = map->owner->storage_cookie[i] == cookie ||
-			      !cookie;
+			ret = map->owner->storage_cookie[i] == cookie;
 		}
 		if (ret &&
 		    map->owner->attach_func_proto != aux->attach_func_proto) {