All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: "Ricardo Cañuelo Navarro" <rcn@igalia.com>,
	"Sasha Levin" <sashal@kernel.org>
Subject: Re: [PATCH 6.6 v3 3/3] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
Date: Thu, 27 Feb 2025 00:08:24 -0500	[thread overview]
Message-ID: <20250226154300-244b0b8a28dc49ee@stable.kernel.org> (raw)
In-Reply-To: <20250226-20250204-kasan-slab-use-after-free-read-in-dev_map_enqueue__submit-v3-3-360efec441ba@igalia.com>

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 9da49aa80d686582bc3a027112a30484c9be6b6e

WARNING: Author mismatch between patch and upstream commit:
Backport author: =?utf-8?q?Ricardo_Ca=C3=B1uelo_Navarro?=<rcn@igalia.com>
Commit author: Jeongjun Park<aha310510@gmail.com>

Note: The patch differs from the upstream commit:
---
1:  9da49aa80d686 ! 1:  f295380a77d57 tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
    @@ Metadata
      ## Commit message ##
         tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
     
    +    [ Upstream commit 9da49aa80d686582bc3a027112a30484c9be6b6e ]
    +
         There are cases where do_xdp_generic returns bpf_net_context without
         clearing it. This causes various memory corruptions, so the missing
         bpf_net_ctx_clear must be added.
    @@ Commit message
         Reported-by: syzbot+61a1cfc2b6632363d319@syzkaller.appspotmail.com
         Reported-by: syzbot+709e4c85c904bcd62735@syzkaller.appspotmail.com
         Signed-off-by: David S. Miller <davem@davemloft.net>
    +    [rcn: trivial backport edit to adapt the patch context.]
    +    Signed-off-by: Ricardo Cañuelo Navarro <rcn@igalia.com>
     
      ## net/core/dev.c ##
    -@@ net/core/dev.c: int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
    +@@ net/core/dev.c: int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff *skb)
      			bpf_net_ctx_clear(bpf_net_ctx);
      			return XDP_DROP;
      		}
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y        |  Success    |  Success   |

  reply	other threads:[~2025-02-27  5:08 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-26  9:39 [PATCH 6.6 v3 0/3] Set the bpf_net_context before invoking BPF XDP in the TUN driver Ricardo Cañuelo Navarro
2025-02-26  9:39 ` [PATCH 6.6 v3 1/3] net: Reference bpf_redirect_info via task_struct on PREEMPT_RT Ricardo Cañuelo Navarro
2025-02-27  5:08   ` Sasha Levin
2025-02-28  4:56   ` Sasha Levin
2025-02-26  9:39 ` [PATCH 6.6 v3 2/3] tun: Assign missing bpf_net_context Ricardo Cañuelo Navarro
2025-02-27  5:08   ` Sasha Levin
2025-02-28  4:56   ` Sasha Levin
2025-02-26  9:39 ` [PATCH 6.6 v3 3/3] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Ricardo Cañuelo Navarro
2025-02-27  5:08   ` Sasha Levin [this message]
2025-02-28  4:56   ` Sasha Levin
2025-02-26 16:31 ` [PATCH 6.6 v3 0/3] Set the bpf_net_context before invoking BPF XDP in the TUN driver Sebastian Andrzej Siewior
2025-02-26 17:12   ` Ricardo Cañuelo Navarro
2025-02-27 16:31 ` Sebastian Andrzej Siewior

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250226154300-244b0b8a28dc49ee@stable.kernel.org \
    --to=sashal@kernel.org \
    --cc=rcn@igalia.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.