From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, rcn@igalia.com
Cc: Sasha Levin <sashal@kernel.org>
Subject: Re: [PATCH 6.6 v3 2/3] tun: Assign missing bpf_net_context.
Date: Thu, 27 Feb 2025 00:08:21 -0500 [thread overview]
Message-ID: <20250226153714-51148a08a89df8bc@stable.kernel.org> (raw)
In-Reply-To: <20250226-20250204-kasan-slab-use-after-free-read-in-dev_map_enqueue__submit-v3-2-360efec441ba@igalia.com>
[ Sasha's backport helper bot ]
Hi,
Summary of potential issues:
ℹ️ This is part 2/3 of a series
⚠️ Found follow-up fixes in mainline
The upstream commit SHA1 provided is correct: fecef4cd42c689a200bdd39e6fffa71475904bc1
WARNING: Author mismatch between patch and upstream commit:
Backport author: =?utf-8?q?Ricardo_Ca=C3=B1uelo_Navarro?=<rcn@igalia.com>
Commit author: Sebastian Andrzej Siewior<bigeasy@linutronix.de>
Found fixes commits:
9da49aa80d68 tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
Note: The patch differs from the upstream commit:
---
1: fecef4cd42c68 ! 1: d614f795c4a67 tun: Assign missing bpf_net_context.
@@ Metadata
## Commit message ##
tun: Assign missing bpf_net_context.
+ [ Upstream commit fecef4cd42c689a200bdd39e6fffa71475904bc1 ]
+
During the introduction of struct bpf_net_context handling for
XDP-redirect, the tun driver has been missed.
Jakub also pointed out that there is another call chain to
@@ Commit message
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20240704144815.j8xQda5r@linutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+ [rcn: Backport the patch to address minor differences in the context lines.
+ These differences are introduced by upstream commits
+ 4d2bb0bfe874 ("xdp: rely on skb pointer reference in do_xdp_generic and
+ netif_receive_generic_xdp") and 7cd1107f48e2a ("bpf, xdp: constify some
+ bpf_prog * function arguments"), which change the parameters in
+ do_xdp_generic() and in calls to netif_receive_generic_xdp(),
+ kfree_skb_reason() and generic_xdp_tx(). These changes aren't
+ significant to the purpose of the patch.]
+ Signed-off-by: Ricardo Cañuelo Navarro <rcn@igalia.com>
## drivers/net/tun.c ##
@@ drivers/net/tun.c: static struct sk_buff *tun_build_skb(struct tun_struct *tun,
@@ drivers/net/tun.c: static int tun_sendmsg(struct socket *sock, struct msghdr *m,
## net/core/dev.c ##
@@ net/core/dev.c: static DEFINE_STATIC_KEY_FALSE(generic_xdp_needed_key);
- int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
+ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff *skb)
{
+ struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
+
@@ net/core/dev.c: static DEFINE_STATIC_KEY_FALSE(generic_xdp_needed_key);
int err;
+ bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
- act = netif_receive_generic_xdp(pskb, &xdp, xdp_prog);
+ act = netif_receive_generic_xdp(skb, &xdp, xdp_prog);
if (act != XDP_PASS) {
switch (act) {
-@@ net/core/dev.c: int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
- generic_xdp_tx(*pskb, xdp_prog);
+@@ net/core/dev.c: int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff *skb)
+ generic_xdp_tx(skb, xdp_prog);
break;
}
+ bpf_net_ctx_clear(bpf_net_ctx);
@@ net/core/dev.c: int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **p
return XDP_PASS;
out_redir:
+ bpf_net_ctx_clear(bpf_net_ctx);
- kfree_skb_reason(*pskb, SKB_DROP_REASON_XDP);
+ kfree_skb_reason(skb, SKB_DROP_REASON_XDP);
return XDP_DROP;
}
---
NOTE: These results are for this patch alone. Full series testing will be
performed when all parts are received.
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y | Success | Success |
next prev parent reply other threads:[~2025-02-27 5:08 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-26 9:39 [PATCH 6.6 v3 0/3] Set the bpf_net_context before invoking BPF XDP in the TUN driver Ricardo Cañuelo Navarro
2025-02-26 9:39 ` [PATCH 6.6 v3 1/3] net: Reference bpf_redirect_info via task_struct on PREEMPT_RT Ricardo Cañuelo Navarro
2025-02-27 5:08 ` Sasha Levin
2025-02-28 4:56 ` Sasha Levin
2025-02-26 9:39 ` [PATCH 6.6 v3 2/3] tun: Assign missing bpf_net_context Ricardo Cañuelo Navarro
2025-02-27 5:08 ` Sasha Levin [this message]
2025-02-28 4:56 ` Sasha Levin
2025-02-26 9:39 ` [PATCH 6.6 v3 3/3] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Ricardo Cañuelo Navarro
2025-02-27 5:08 ` Sasha Levin
2025-02-28 4:56 ` Sasha Levin
2025-02-26 16:31 ` [PATCH 6.6 v3 0/3] Set the bpf_net_context before invoking BPF XDP in the TUN driver Sebastian Andrzej Siewior
2025-02-26 17:12 ` Ricardo Cañuelo Navarro
2025-02-27 16:31 ` Sebastian Andrzej Siewior
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250226153714-51148a08a89df8bc@stable.kernel.org \
--to=sashal@kernel.org \
--cc=rcn@igalia.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.