All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Puranjay Mohan <puranjay@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: Re: [PATCH stable linux-5.10.y v1 2/8] bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
Date: Wed, 11 Jun 2025 09:15:59 -0400	[thread overview]
Message-ID: <20250610171347-e4a5675789d3a672@stable.kernel.org> (raw)
In-Reply-To: <20250610144407.95865-3-puranjay@kernel.org>

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 48946bd6a5d695c50b34546864b79c1f910a33c1

WARNING: Author mismatch between patch and upstream commit:
Backport author: Puranjay Mohan<puranjay@kernel.org>
Commit author: Hao Luo<haoluo@google.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.14.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Present (exact SHA1)
6.1.y | Present (exact SHA1)
5.15.y | Present (different SHA1: d58a396fa6c9)

Note: The patch differs from the upstream commit:
---
1:  48946bd6a5d69 ! 1:  4b4f340273f41 bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
    @@ Metadata
      ## Commit message ##
         bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
     
    +    commit 48946bd6a5d695c50b34546864b79c1f910a33c1 upstream.
    +
         We have introduced a new type to make bpf_arg composable, by
         reserving high bits of bpf_arg to represent flags of a type.
     
    @@ Commit message
     
         Signed-off-by: Hao Luo <haoluo@google.com>
         Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    +    Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
         Link: https://lore.kernel.org/bpf/20211217003152.48334-3-haoluo@google.com
    +    Cc: stable@vger.kernel.org # 5.10.x
     
      ## include/linux/bpf.h ##
     @@ include/linux/bpf.h: enum bpf_arg_type {
    @@ include/linux/bpf.h: enum bpf_arg_type {
      	ARG_CONST_ALLOC_SIZE_OR_ZERO,	/* number of allocated bytes requested */
      	ARG_PTR_TO_BTF_ID_SOCK_COMMON,	/* pointer to in-kernel sock_common or bpf-mirrored bpf_sock */
      	ARG_PTR_TO_PERCPU_BTF_ID,	/* pointer to in-kernel percpu type */
    - 	ARG_PTR_TO_FUNC,	/* pointer to a bpf program function */
    --	ARG_PTR_TO_STACK_OR_NULL,	/* pointer to stack or NULL */
    -+	ARG_PTR_TO_STACK,	/* pointer to stack */
    - 	ARG_PTR_TO_CONST_STR,	/* pointer to a null terminated read-only string */
    - 	ARG_PTR_TO_TIMER,	/* pointer to bpf_timer */
      	__BPF_ARG_TYPE_MAX,
      
     +	/* Extended arg_types. */
    @@ include/linux/bpf.h: enum bpf_arg_type {
     +	ARG_PTR_TO_CTX_OR_NULL		= PTR_MAYBE_NULL | ARG_PTR_TO_CTX,
     +	ARG_PTR_TO_SOCKET_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_SOCKET,
     +	ARG_PTR_TO_ALLOC_MEM_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_ALLOC_MEM,
    -+	ARG_PTR_TO_STACK_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_STACK,
     +
      	/* This must be the last entry. Its purpose is to ensure the enum is
      	 * wide enough to hold the higher bits reserved for bpf_type_flag.
    @@ kernel/bpf/verifier.c: static bool arg_type_may_be_refcounted(enum bpf_arg_type
     -	       type == ARG_PTR_TO_MEM_OR_NULL ||
     -	       type == ARG_PTR_TO_CTX_OR_NULL ||
     -	       type == ARG_PTR_TO_SOCKET_OR_NULL ||
    --	       type == ARG_PTR_TO_ALLOC_MEM_OR_NULL ||
    --	       type == ARG_PTR_TO_STACK_OR_NULL;
    +-	       type == ARG_PTR_TO_ALLOC_MEM_OR_NULL;
     +	return type & PTR_MAYBE_NULL;
      }
      
      /* Determine whether the function releases some resources allocated by another
    -@@ kernel/bpf/verifier.c: static int process_timer_func(struct bpf_verifier_env *env, int regno,
    +@@ kernel/bpf/verifier.c: static int process_spin_lock(struct bpf_verifier_env *env, int regno,
      
      static bool arg_type_is_mem_ptr(enum bpf_arg_type type)
      {
    @@ kernel/bpf/verifier.c: static const struct bpf_reg_types *compatible_reg_types[_
      	[ARG_PTR_TO_INT]		= &int_ptr_types,
      	[ARG_PTR_TO_LONG]		= &int_ptr_types,
      	[ARG_PTR_TO_PERCPU_BTF_ID]	= &percpu_btf_ptr_types,
    - 	[ARG_PTR_TO_FUNC]		= &func_ptr_types,
    --	[ARG_PTR_TO_STACK_OR_NULL]	= &stack_ptr_types,
    -+	[ARG_PTR_TO_STACK]		= &stack_ptr_types,
    - 	[ARG_PTR_TO_CONST_STR]		= &const_str_ptr_types,
    - 	[ARG_PTR_TO_TIMER]		= &timer_types,
    - };
     @@ kernel/bpf/verifier.c: static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
      	const struct bpf_reg_types *compatible;
      	int i, j;
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.15.y       |  Success    |  Success   |

  reply	other threads:[~2025-06-11 13:16 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-06-10 14:43 [PATCH stable linux-5.10.y v1 0/8] Fix bpf mem read/write vulnerability Puranjay Mohan
2025-06-10 14:43 ` [PATCH stable linux-5.10.y v1 1/8] bpf: Introduce composable reg, ret and arg types Puranjay Mohan
2025-06-11 13:16   ` Sasha Levin
2025-06-10 14:43 ` [PATCH stable linux-5.10.y v1 2/8] bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL Puranjay Mohan
2025-06-11 13:15   ` Sasha Levin [this message]
2025-06-10 14:43 ` [PATCH stable linux-5.10.y v1 3/8] bpf: Replace RET_XXX_OR_NULL with RET_XXX " Puranjay Mohan
2025-06-11 13:24   ` Sasha Levin
2025-06-10 14:43 ` [PATCH stable linux-5.10.y v1 4/8] bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX " Puranjay Mohan
2025-06-11 13:16   ` Sasha Levin
2025-06-10 14:44 ` [PATCH stable linux-5.10.y v1 5/8] bpf: Introduce MEM_RDONLY flag Puranjay Mohan
2025-06-10 14:44 ` [PATCH stable linux-5.10.y v1 6/8] bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM Puranjay Mohan
2025-06-10 14:44 ` [PATCH stable linux-5.10.y v1 7/8] bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem Puranjay Mohan
2025-06-10 14:44 ` [PATCH stable linux-5.10.y v1 8/8] bpf/selftests: Test PTR_TO_RDONLY_MEM Puranjay Mohan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250610171347-e4a5675789d3a672@stable.kernel.org \
    --to=sashal@kernel.org \
    --cc=puranjay@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.