Re: [PATCH stable 6.6 03/10] bpf: track changes_pkt_data property for global functions

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 51081a3f25c742da5a659d7fc6fd77ebfdd555be

WARNING: Author mismatch between patch and upstream commit:
Backport author: Shung-Hsi Yu<shung-hsi.yu@suse.com>
Commit author: Eduard Zingerman<eddyz87@gmail.com>

Status in newer kernel trees:
6.14.y | Present (exact SHA1)
6.12.y | Present (different SHA1: 1d572c60488b)

Note: The patch differs from the upstream commit:
---
1:  51081a3f25c74 ! 1:  5e482602aa8a7 bpf: track changes_pkt_data property for global functions
    @@ Metadata
      ## Commit message ##
         bpf: track changes_pkt_data property for global functions
     
    +    commit 51081a3f25c742da5a659d7fc6fd77ebfdd555be upstream.
    +
         When processing calls to certain helpers, verifier invalidates all
         packet pointers in a current state. For example, consider the
         following program:
    @@ Commit message
         Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
         Link: https://lore.kernel.org/r/20241210041100.1898468-4-eddyz87@gmail.com
         Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    +    [shung-hsi.yu: do not use bitfield in "struct bpf_subprog_info" because commit
    +    406a6fa44bfb ("bpf: use bitfields for simple per-subprog bool flags") is not
    +    present and minor context difference in check_func_call() because commit
    +    491dd8edecbc ("bpf: Emit global subprog name in verifier logs") is not present. ]
    +    Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
     
      ## include/linux/bpf_verifier.h ##
     @@ include/linux/bpf_verifier.h: struct bpf_subprog_info {
    - 	bool args_cached: 1;
    - 	/* true if bpf_fastcall stack region is used by functions that can't be inlined */
    - 	bool keep_fastcall_stack: 1;
    -+	bool changes_pkt_data: 1;
    + 	bool tail_call_reachable;
    + 	bool has_ld_abs;
    + 	bool is_async_cb;
    ++	bool changes_pkt_data;
    + };
      
    - 	enum priv_stack_mode priv_stack_mode;
    - 	u8 arg_cnt;
    + struct bpf_verifier_env;
     
      ## kernel/bpf/verifier.c ##
     @@ kernel/bpf/verifier.c: static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
      
    - 		verbose(env, "Func#%d ('%s') is global and assumed valid.\n",
    - 			subprog, sub_name);
    + 		if (env->log.level & BPF_LOG_LEVEL)
    + 			verbose(env, "Func#%d is global and valid. Skipping.\n", subprog);
     +		if (env->subprog_info[subprog].changes_pkt_data)
     +			clear_all_pkt_pointers(env);
    - 		/* mark global subprog for verifying after main prog */
    - 		subprog_aux(env, subprog)->called = true;
      		clear_caller_saved_regs(env, caller->regs);
    -@@ kernel/bpf/verifier.c: static int check_return_code(struct bpf_verifier_env *env, int regno, const char
    + 
    + 		/* All global functions return a 64-bit SCALAR_VALUE */
    +@@ kernel/bpf/verifier.c: static int check_return_code(struct bpf_verifier_env *env)
      	return 0;
      }
      
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.12.y       |  Success    |  Success   |