All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Martin KaFai Lau <martin.lau@linux.dev>,
	syzbot+608a2acde8c5a101d07d@syzkaller.appspotmail.com,
	Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Martin KaFai Lau <martin.lau@kernel.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 06/43] bpf: Remove tst_run from lwt_seg6local_prog_ops.
Date: Mon, 31 Aug 2026 15:35:14 +0200	[thread overview]
Message-ID: <20260831133358.832009876@linuxfoundation.org> (raw)
In-Reply-To: <20260831133358.571886287@linuxfoundation.org>

5.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit c13fda93aca118b8e5cd202e339046728ee7dddb ]

The syzbot reported that the lwt_seg6 related BPF ops can be invoked
via bpf_test_run() without without entering input_action_end_bpf()
first.

Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
probably didn't work since it was introduced in commit 04d4b274e2a
("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
test case but each BPF function expects it.

Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.

Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Reported-by: syzbot+608a2acde8c5a101d07d@syzkaller.appspotmail.com
Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.")
Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/filter.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 18d8094d87591..8ec5b4d868ab9 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9920,7 +9920,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = {
 };
 
 const struct bpf_prog_ops lwt_seg6local_prog_ops = {
-	.test_run		= bpf_prog_test_run_skb,
 };
 
 const struct bpf_verifier_ops cg_sock_verifier_ops = {
-- 
2.53.0




  parent reply	other threads:[~2026-08-31 14:07 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-31 13:35 [PATCH 5.10 00/43] 5.10.269-rc1 review Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 01/43] RDMA/rxe: Fix OOB in free_rd_atomic_resources() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 02/43] ipv6: mcast: Fix use-after-free when processing MLD queries Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 03/43] ext4: dont enable DAX on new encrypted files Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 04/43] ipvs: reload ip header after head reallocation Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 05/43] io_uring/io-wq: fix worker accounting when canceling creation callbacks Greg Kroah-Hartman
2026-08-31 13:35 ` Greg Kroah-Hartman [this message]
2026-08-31 13:35 ` [PATCH 5.10 07/43] jfs: add check read-only before truncation in jfs_truncate_nolock() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 08/43] jfs: add check read-only before txBeginAnon() call Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 09/43] KVM: arm64: Prevent access to vCPU events before init Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 10/43] bpf: Fix use-after-free in offloaded map/prog info fill Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 11/43] Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 12/43] selinux: switch two allocations to use kzalloc_objs() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 13/43] Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 14/43] Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 15/43] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 16/43] kcov: fix data corruption and race conditions on PREEMPT_RT Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 17/43] ext4: propagate errors from fast commit range replay Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 18/43] nilfs2: reject invalid block index in GC ioctl Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 19/43] nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 20/43] HID: magicmouse: do not keep a stale msc->input if no input is claimed Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 21/43] nfc: nci: add data_len bound checks to activation parameter extractors Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 22/43] nvmet-tcp: bound SGL data length before allocating command buffers Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 23/43] HID: input: read battery capacity from its actual report offset Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 24/43] fpga: dfl: fme: add error handling Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 25/43] accessibility: speakup: unregister tty ldisc on later init failures Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 26/43] usb: usbtest: disable dynamic ID support Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 27/43] usb: gadget: f_tcm: keep port count until LUN teardown completes Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 28/43] xfrm: espintcp: fix UAF during close Greg Kroah-Hartman
2026-09-04  9:51   ` D. Wythe
2026-09-04 12:15     ` Greg Kroah-Hartman
2026-09-05 10:17       ` D. Wythe
2026-09-05 11:16         ` Greg Kroah-Hartman
2026-09-08  0:53         ` Sasha Levin
2026-09-06 13:32     ` Sasha Levin
2026-08-31 13:35 ` [PATCH 5.10 29/43] xfrm: drop ESP-in-TCP packets with no ingress device Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 30/43] xfrm: ah6: validate routing header segments_left Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 31/43] xfrm: fix xfrm_state_construct() auth-trunc leak Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 32/43] ipv6: seg6: clear IPv4 control block on IPIP decapsulation Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 33/43] mm/swap: reject swapon() on filesystem-level encrypted files Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 34/43] crypto: atmel-tdes - use scatterlist length before DMA mapping Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 35/43] crypto: mxs-dcp - fix source scatterlist length access Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 36/43] KVM: s390: vsie: zero stale crypto bits Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 37/43] usb: core: Add lock to usb_wakeup_notification() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 38/43] usb: core: Strengthen error handling in hub_hub_status() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 39/43] ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 40/43] USB: serial: option: fix slab OOB read in interrupt URB callback Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 41/43] USB: serial: spcp8x5: drop broken carrier detect support Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 42/43] USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 43/43] usb: usbfs: fix use-after-free of usb_device in usbdev_release() Greg Kroah-Hartman
2026-08-31 17:01 ` [PATCH 5.10 00/43] 5.10.269-rc1 review Florian Fainelli
2026-08-31 19:23 ` Brett A C Sheffield
2026-08-31 20:58 ` Woody Suwalski
2026-09-01  2:00 ` Dominique Martinet
2026-09-01  8:45 ` Pavel Machek
2026-09-01 16:48 ` Shuah Khan
2026-09-02  0:11 ` Barry K. Nathan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260831133358.832009876@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=bigeasy@linutronix.de \
    --cc=daniel@iogearbox.net \
    --cc=martin.lau@kernel.org \
    --cc=martin.lau@linux.dev \
    --cc=patches@lists.linux.dev \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+608a2acde8c5a101d07d@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.