[PATCH bpf-next] bpf: Remove tst_run from lwt_seg6local_prog_ops.

[PATCH bpf-next] bpf: Remove tst_run from lwt_seg6local_prog_ops.

[Sebastian Andrzej Siewior]

The syzbot reported that the lwt_seg6 related BPF ops can be invoked
via bpf_test_run() without without entering input_action_end_bpf()
first.

Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
probably didn't work since it was introduced in commit 04d4b274e2a
("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
test case but each BPF function expects it.

Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.

Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Reported-by: syzbot+608a2acde8c5a101d07d@syzkaller.appspotmail.com
Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
 net/core/filter.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index d767880c276d9..4cf1d34f76172 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -11053,7 +11053,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = {
 };
 
 const struct bpf_prog_ops lwt_seg6local_prog_ops = {
-	.test_run		= bpf_prog_test_run_skb,
 };
 
 const struct bpf_verifier_ops cg_sock_verifier_ops = {
-- 
2.45.2

Re: [PATCH bpf-next] bpf: Remove tst_run from lwt_seg6local_prog_ops.

[Daniel Borkmann]

On 7/10/24 4:16 PM, Sebastian Andrzej Siewior wrote:
> The syzbot reported that the lwt_seg6 related BPF ops can be invoked
> via bpf_test_run() without without entering input_action_end_bpf()
> first.
> 
> Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
> probably didn't work since it was introduced in commit 04d4b274e2a
> ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
> per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
> test case but each BPF function expects it.
> 
> Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.
> 
> Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
> Reported-by: syzbot+608a2acde8c5a101d07d@syzkaller.appspotmail.com
> Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.")

We can also add in addition for reference:

Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF")

> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Acked-by: Daniel Borkmann <daniel@iogearbox.net>

Re: [PATCH bpf-next] bpf: Remove tst_run from lwt_seg6local_prog_ops.

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Martin KaFai Lau <martin.lau@kernel.org>:

On Wed, 10 Jul 2024 16:16:31 +0200 you wrote:
> The syzbot reported that the lwt_seg6 related BPF ops can be invoked
> via bpf_test_run() without without entering input_action_end_bpf()
> first.
> 
> Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
> probably didn't work since it was introduced in commit 04d4b274e2a
> ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
> per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
> test case but each BPF function expects it.
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Remove tst_run from lwt_seg6local_prog_ops.
    https://git.kernel.org/bpf/bpf-next/c/c13fda93aca1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH bpf-next] bpf: Remove tst_run from lwt_seg6local_prog_ops.

[Martin KaFai Lau]

On 7/10/24 8:16 AM, Daniel Borkmann wrote:
> On 7/10/24 4:16 PM, Sebastian Andrzej Siewior wrote:
>> The syzbot reported that the lwt_seg6 related BPF ops can be invoked
>> via bpf_test_run() without without entering input_action_end_bpf()
>> first.
>>
>> Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
>> probably didn't work since it was introduced in commit 04d4b274e2a
>> ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
>> per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
>> test case but each BPF function expects it.
>>
>> Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.
>>
>> Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
>> Reported-by: syzbot+608a2acde8c5a101d07d@syzkaller.appspotmail.com
>> Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.")
> 
> We can also add in addition for reference:
> 
> Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF")

Added the Fixes tag before applying.

Thanks!