* [PATCH 6.6.y/6.12.y/6.18.y 1/2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs
2026-07-22 7:39 [PATCH 6.6.y/6.12.y/6.18.y 0/2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs Philo Lu
@ 2026-07-22 7:39 ` Philo Lu
2026-07-22 8:49 ` Pu Lehui
2026-07-22 7:39 ` [PATCH 6.6.y/6.12.y/6.18.y 2/2] selftests/bpf: Add tests for ld_{abs,ind} failure path " Philo Lu
2026-07-24 11:22 ` [PATCH 6.6.y/6.12.y/6.18.y 0/2] bpf: Fix ld_{abs,ind} failure path analysis " Sasha Levin
2 siblings, 1 reply; 6+ messages in thread
From: Philo Lu @ 2026-07-22 7:39 UTC (permalink / raw)
To: stable
Cc: daniel, info, ast, lulie, john.fastabend, andrii, martin.lau,
song, yonghong.song, kpsingh, sdf, haoluo, jolsa, bpf,
linux-kernel, mykolal, shuah, linux-kselftest, dust.li
From: Daniel Borkmann <daniel@iogearbox.net>
commit ee861486e377edc55361c08dcbceab3f6b6577bd upstream.
Usage of ld_{abs,ind} instructions got extended into subprogs some time
ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These
are only allowed in subprograms when the latter are BTF annotated and
have scalar return types.
The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +
exit) from legacy cBPF times. While the enforcement is on scalar return
types, the verifier must also simulate the path of abnormal exit if the
packet data load via ld_{abs,ind} failed.
This is currently not the case. Fix it by having the verifier simulate
both success and failure paths, and extend it in similar ways as we do
for tail calls. The success path (r0=unknown, continue to next insn) is
pushed onto stack for later validation and the r0=0 and return to the
caller is done on the fall-through side.
Fixes: 09b28d76eac4 ("bpf: Add abnormal return checks.")
Reported-by: STAR Labs SG <info@starlabs.sg>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260408191242.526279-2-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[ Dropped visit_abnormal_return_insn changes: depends on 7.0 symbols from
e40f5a6bf88a ("bpf: correct stack liveness for tail calls");
Hunk1: adapted IS_ERR/PTR_ERR to !branch/-EFAULT to match push_stack()
NULL-on-failure convention. ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
---
kernel/bpf/verifier.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f638b2d3a42fb..3f74767e47484 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15119,6 +15119,23 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
mark_reg_unknown(env, regs, BPF_REG_0);
/* ld_abs load up to 32-bit skb data. */
regs[BPF_REG_0].subreg_def = env->insn_idx + 1;
+ /*
+ * See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0
+ * which must be explored by the verifier when in a subprog.
+ */
+ if (env->cur_state->curframe) {
+ struct bpf_verifier_state *branch;
+
+ mark_reg_scratched(env, BPF_REG_0);
+ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
+ if (!branch)
+ return -EFAULT;
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+ err = prepare_func_exit(env, &env->insn_idx);
+ if (err)
+ return err;
+ env->insn_idx--;
+ }
return 0;
}
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 6.6.y/6.12.y/6.18.y 1/2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs
2026-07-22 7:39 ` [PATCH 6.6.y/6.12.y/6.18.y 1/2] " Philo Lu
@ 2026-07-22 8:49 ` Pu Lehui
0 siblings, 0 replies; 6+ messages in thread
From: Pu Lehui @ 2026-07-22 8:49 UTC (permalink / raw)
To: Philo Lu, stable
Cc: daniel, info, ast, john.fastabend, andrii, martin.lau, song,
yonghong.song, kpsingh, sdf, haoluo, jolsa, bpf, linux-kernel,
mykolal, shuah, linux-kselftest, dust.li
On 2026/7/22 15:39, Philo Lu wrote:
> From: Daniel Borkmann <daniel@iogearbox.net>
>
> commit ee861486e377edc55361c08dcbceab3f6b6577bd upstream.
>
> Usage of ld_{abs,ind} instructions got extended into subprogs some time
> ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These
> are only allowed in subprograms when the latter are BTF annotated and
> have scalar return types.
>
> The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +
> exit) from legacy cBPF times. While the enforcement is on scalar return
> types, the verifier must also simulate the path of abnormal exit if the
> packet data load via ld_{abs,ind} failed.
>
> This is currently not the case. Fix it by having the verifier simulate
> both success and failure paths, and extend it in similar ways as we do
> for tail calls. The success path (r0=unknown, continue to next insn) is
> pushed onto stack for later validation and the r0=0 and return to the
> caller is done on the fall-through side.
>
> Fixes: 09b28d76eac4 ("bpf: Add abnormal return checks.")
> Reported-by: STAR Labs SG <info@starlabs.sg>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Link: https://lore.kernel.org/r/20260408191242.526279-2-daniel@iogearbox.net
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> [ Dropped visit_abnormal_return_insn changes: depends on 7.0 symbols from
> e40f5a6bf88a ("bpf: correct stack liveness for tail calls");
> Hunk1: adapted IS_ERR/PTR_ERR to !branch/-EFAULT to match push_stack()
> NULL-on-failure convention. ]
These versions does not introduce consumers corresponding to the output
of jump tables; therefore, the assignment of jump tables is not involved.
Reviewed-by: Pu Lehui <pulehui@huawei.com>
> Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
> ---
> kernel/bpf/verifier.c | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index f638b2d3a42fb..3f74767e47484 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -15119,6 +15119,23 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
> mark_reg_unknown(env, regs, BPF_REG_0);
> /* ld_abs load up to 32-bit skb data. */
> regs[BPF_REG_0].subreg_def = env->insn_idx + 1;
> + /*
> + * See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0
> + * which must be explored by the verifier when in a subprog.
> + */
> + if (env->cur_state->curframe) {
> + struct bpf_verifier_state *branch;
> +
> + mark_reg_scratched(env, BPF_REG_0);
> + branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
> + if (!branch)
> + return -EFAULT;
> + mark_reg_known_zero(env, regs, BPF_REG_0);
> + err = prepare_func_exit(env, &env->insn_idx);
> + if (err)
> + return err;
> + env->insn_idx--;
> + }
> return 0;
> }
>
> --
> 2.47.3
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 6.6.y/6.12.y/6.18.y 2/2] selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
2026-07-22 7:39 [PATCH 6.6.y/6.12.y/6.18.y 0/2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs Philo Lu
2026-07-22 7:39 ` [PATCH 6.6.y/6.12.y/6.18.y 1/2] " Philo Lu
@ 2026-07-22 7:39 ` Philo Lu
2026-07-22 8:50 ` Pu Lehui
2026-07-24 11:22 ` [PATCH 6.6.y/6.12.y/6.18.y 0/2] bpf: Fix ld_{abs,ind} failure path analysis " Sasha Levin
2 siblings, 1 reply; 6+ messages in thread
From: Philo Lu @ 2026-07-22 7:39 UTC (permalink / raw)
To: stable
Cc: daniel, info, ast, lulie, john.fastabend, andrii, martin.lau,
song, yonghong.song, kpsingh, sdf, haoluo, jolsa, bpf,
linux-kernel, mykolal, shuah, linux-kselftest, dust.li
From: Daniel Borkmann <daniel@iogearbox.net>
commit e0fcb42bc6f41bab2895757d6610616b3820eff7 upstream.
Extend the verifier_ld_ind BPF selftests with subprogs containing
ld_{abs,ind} and craft the test in a way where the invalid register
read is rejected in the fixed case. Also add a success case each,
and add additional coverage related to the BTF return type enforcement.
# LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_ld_ind
[...]
#611/1 verifier_ld_ind/ld_ind: check calling conv, r1:OK
#611/2 verifier_ld_ind/ld_ind: check calling conv, r1 @unpriv:OK
#611/3 verifier_ld_ind/ld_ind: check calling conv, r2:OK
#611/4 verifier_ld_ind/ld_ind: check calling conv, r2 @unpriv:OK
#611/5 verifier_ld_ind/ld_ind: check calling conv, r3:OK
#611/6 verifier_ld_ind/ld_ind: check calling conv, r3 @unpriv:OK
#611/7 verifier_ld_ind/ld_ind: check calling conv, r4:OK
#611/8 verifier_ld_ind/ld_ind: check calling conv, r4 @unpriv:OK
#611/9 verifier_ld_ind/ld_ind: check calling conv, r5:OK
#611/10 verifier_ld_ind/ld_ind: check calling conv, r5 @unpriv:OK
#611/11 verifier_ld_ind/ld_ind: check calling conv, r7:OK
#611/12 verifier_ld_ind/ld_ind: check calling conv, r7 @unpriv:OK
#611/13 verifier_ld_ind/ld_abs: subprog early exit on ld_abs failure:OK
#611/14 verifier_ld_ind/ld_ind: subprog early exit on ld_ind failure:OK
#611/15 verifier_ld_ind/ld_abs: subprog with both paths safe:OK
#611/16 verifier_ld_ind/ld_ind: subprog with both paths safe:OK
#611/17 verifier_ld_ind/ld_abs: reject void return subprog:OK
#611/18 verifier_ld_ind/ld_ind: reject void return subprog:OK
#611 verifier_ld_ind:OK
Summary: 1/18 PASSED, 0 SKIPPED, 0 FAILED
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260408191242.526279-4-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
---
.../selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++++++++++++++
1 file changed, 142 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_ld_ind.c b/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
index c925ba9a2e74c..09e81b99eecb4 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
@@ -107,4 +107,146 @@ __naked void ind_check_calling_conv_r7(void)
: __clobber_all);
}
+/*
+ * ld_{abs,ind} subprog that always sets r0=1 on the success path.
+ * bpf_gen_ld_abs() emits a hidden exit with r0=0 when the load helper
+ * fails. The verifier must model this failure return so that callers
+ * account for r0=0 as a possible return value.
+ */
+__naked __noinline __used
+static int ldabs_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ ".8byte %[ld_abs];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
+ : __clobber_all);
+}
+
+__naked __noinline __used
+static int ldind_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ "r7 = 0;"
+ ".8byte %[ld_ind];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
+ : __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: subprog early exit on ld_abs failure")
+__failure __msg("R9 !read_ok")
+__naked void ld_abs_subprog_early_exit(void)
+{
+ asm volatile (
+ "call ldabs_subprog;"
+ "if r0 != 0 goto l_exit_%=;"
+ "r0 = r9;"
+ "l_exit_%=:"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: subprog early exit on ld_ind failure")
+__failure __msg("R9 !read_ok")
+__naked void ld_ind_subprog_early_exit(void)
+{
+ asm volatile (
+ "call ldind_subprog;"
+ "if r0 != 0 goto l_exit_%=;"
+ "r0 = r9;"
+ "l_exit_%=:"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: subprog with both paths safe")
+__success
+__naked void ld_abs_subprog_both_paths_safe(void)
+{
+ asm volatile (
+ "call ldabs_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: subprog with both paths safe")
+__success
+__naked void ld_ind_subprog_both_paths_safe(void)
+{
+ asm volatile (
+ "call ldind_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+/*
+ * ld_{abs,ind} in subprogs require scalar (int) return type in BTF.
+ * A test with void return must be rejected.
+ */
+__naked __noinline __used
+static void ldabs_void_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ ".8byte %[ld_abs];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
+ : __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: reject void return subprog")
+__failure __msg("LD_ABS is only allowed in functions that return 'int'")
+__naked void ld_abs_void_subprog_reject(void)
+{
+ asm volatile (
+ "call ldabs_void_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+__naked __noinline __used
+static void ldind_void_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ "r7 = 0;"
+ ".8byte %[ld_ind];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
+ : __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: reject void return subprog")
+__failure __msg("LD_ABS is only allowed in functions that return 'int'")
+__naked void ld_ind_void_subprog_reject(void)
+{
+ asm volatile (
+ "call ldind_void_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
char _license[] SEC("license") = "GPL";
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 6.6.y/6.12.y/6.18.y 2/2] selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
2026-07-22 7:39 ` [PATCH 6.6.y/6.12.y/6.18.y 2/2] selftests/bpf: Add tests for ld_{abs,ind} failure path " Philo Lu
@ 2026-07-22 8:50 ` Pu Lehui
0 siblings, 0 replies; 6+ messages in thread
From: Pu Lehui @ 2026-07-22 8:50 UTC (permalink / raw)
To: Philo Lu, stable
Cc: daniel, info, ast, john.fastabend, andrii, martin.lau, song,
yonghong.song, kpsingh, sdf, haoluo, jolsa, bpf, linux-kernel,
mykolal, shuah, linux-kselftest, dust.li
On 2026/7/22 15:39, Philo Lu wrote:
> From: Daniel Borkmann <daniel@iogearbox.net>
>
> commit e0fcb42bc6f41bab2895757d6610616b3820eff7 upstream.
>
> Extend the verifier_ld_ind BPF selftests with subprogs containing
> ld_{abs,ind} and craft the test in a way where the invalid register
> read is rejected in the fixed case. Also add a success case each,
> and add additional coverage related to the BTF return type enforcement.
>
> # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_ld_ind
> [...]
> #611/1 verifier_ld_ind/ld_ind: check calling conv, r1:OK
> #611/2 verifier_ld_ind/ld_ind: check calling conv, r1 @unpriv:OK
> #611/3 verifier_ld_ind/ld_ind: check calling conv, r2:OK
> #611/4 verifier_ld_ind/ld_ind: check calling conv, r2 @unpriv:OK
> #611/5 verifier_ld_ind/ld_ind: check calling conv, r3:OK
> #611/6 verifier_ld_ind/ld_ind: check calling conv, r3 @unpriv:OK
> #611/7 verifier_ld_ind/ld_ind: check calling conv, r4:OK
> #611/8 verifier_ld_ind/ld_ind: check calling conv, r4 @unpriv:OK
> #611/9 verifier_ld_ind/ld_ind: check calling conv, r5:OK
> #611/10 verifier_ld_ind/ld_ind: check calling conv, r5 @unpriv:OK
> #611/11 verifier_ld_ind/ld_ind: check calling conv, r7:OK
> #611/12 verifier_ld_ind/ld_ind: check calling conv, r7 @unpriv:OK
> #611/13 verifier_ld_ind/ld_abs: subprog early exit on ld_abs failure:OK
> #611/14 verifier_ld_ind/ld_ind: subprog early exit on ld_ind failure:OK
> #611/15 verifier_ld_ind/ld_abs: subprog with both paths safe:OK
> #611/16 verifier_ld_ind/ld_ind: subprog with both paths safe:OK
> #611/17 verifier_ld_ind/ld_abs: reject void return subprog:OK
> #611/18 verifier_ld_ind/ld_ind: reject void return subprog:OK
> #611 verifier_ld_ind:OK
> Summary: 1/18 PASSED, 0 SKIPPED, 0 FAILED
>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Link: https://lore.kernel.org/r/20260408191242.526279-4-daniel@iogearbox.net
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
> ---
> .../selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++++++++++++++
> 1 file changed, 142 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/progs/verifier_ld_ind.c b/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
> index c925ba9a2e74c..09e81b99eecb4 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
> @@ -107,4 +107,146 @@ __naked void ind_check_calling_conv_r7(void)
> : __clobber_all);
> }
>
> +/*
> + * ld_{abs,ind} subprog that always sets r0=1 on the success path.
> + * bpf_gen_ld_abs() emits a hidden exit with r0=0 when the load helper
> + * fails. The verifier must model this failure return so that callers
> + * account for r0=0 as a possible return value.
> + */
> +__naked __noinline __used
> +static int ldabs_subprog(void)
> +{
> + asm volatile (
> + "r6 = r1;"
> + ".8byte %[ld_abs];"
> + "r0 = 1;"
> + "exit;"
> + :
> + : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
> + : __clobber_all);
> +}
> +
> +__naked __noinline __used
> +static int ldind_subprog(void)
> +{
> + asm volatile (
> + "r6 = r1;"
> + "r7 = 0;"
> + ".8byte %[ld_ind];"
> + "r0 = 1;"
> + "exit;"
> + :
> + : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
> + : __clobber_all);
> +}
> +
> +SEC("socket")
> +__description("ld_abs: subprog early exit on ld_abs failure")
> +__failure __msg("R9 !read_ok")
> +__naked void ld_abs_subprog_early_exit(void)
> +{
> + asm volatile (
> + "call ldabs_subprog;"
> + "if r0 != 0 goto l_exit_%=;"
> + "r0 = r9;"
> + "l_exit_%=:"
> + "r0 = 0;"
> + "exit;"
> + ::: __clobber_all);
> +}
> +
> +SEC("socket")
> +__description("ld_ind: subprog early exit on ld_ind failure")
> +__failure __msg("R9 !read_ok")
> +__naked void ld_ind_subprog_early_exit(void)
> +{
> + asm volatile (
> + "call ldind_subprog;"
> + "if r0 != 0 goto l_exit_%=;"
> + "r0 = r9;"
> + "l_exit_%=:"
> + "r0 = 0;"
> + "exit;"
> + ::: __clobber_all);
> +}
> +
> +SEC("socket")
> +__description("ld_abs: subprog with both paths safe")
> +__success
> +__naked void ld_abs_subprog_both_paths_safe(void)
> +{
> + asm volatile (
> + "call ldabs_subprog;"
> + "r0 = 0;"
> + "exit;"
> + ::: __clobber_all);
> +}
> +
> +SEC("socket")
> +__description("ld_ind: subprog with both paths safe")
> +__success
> +__naked void ld_ind_subprog_both_paths_safe(void)
> +{
> + asm volatile (
> + "call ldind_subprog;"
> + "r0 = 0;"
> + "exit;"
> + ::: __clobber_all);
> +}
> +
> +/*
> + * ld_{abs,ind} in subprogs require scalar (int) return type in BTF.
> + * A test with void return must be rejected.
> + */
> +__naked __noinline __used
> +static void ldabs_void_subprog(void)
> +{
> + asm volatile (
> + "r6 = r1;"
> + ".8byte %[ld_abs];"
> + "r0 = 1;"
> + "exit;"
> + :
> + : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
> + : __clobber_all);
> +}
> +
> +SEC("socket")
> +__description("ld_abs: reject void return subprog")
> +__failure __msg("LD_ABS is only allowed in functions that return 'int'")
> +__naked void ld_abs_void_subprog_reject(void)
> +{
> + asm volatile (
> + "call ldabs_void_subprog;"
> + "r0 = 0;"
> + "exit;"
> + ::: __clobber_all);
> +}
> +
> +__naked __noinline __used
> +static void ldind_void_subprog(void)
> +{
> + asm volatile (
> + "r6 = r1;"
> + "r7 = 0;"
> + ".8byte %[ld_ind];"
> + "r0 = 1;"
> + "exit;"
> + :
> + : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
> + : __clobber_all);
> +}
> +
> +SEC("socket")
> +__description("ld_ind: reject void return subprog")
> +__failure __msg("LD_ABS is only allowed in functions that return 'int'")
> +__naked void ld_ind_void_subprog_reject(void)
> +{
> + asm volatile (
> + "call ldind_void_subprog;"
> + "r0 = 0;"
> + "exit;"
> + ::: __clobber_all);
> +}
> +
> char _license[] SEC("license") = "GPL";
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 6.6.y/6.12.y/6.18.y 0/2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs
2026-07-22 7:39 [PATCH 6.6.y/6.12.y/6.18.y 0/2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs Philo Lu
2026-07-22 7:39 ` [PATCH 6.6.y/6.12.y/6.18.y 1/2] " Philo Lu
2026-07-22 7:39 ` [PATCH 6.6.y/6.12.y/6.18.y 2/2] selftests/bpf: Add tests for ld_{abs,ind} failure path " Philo Lu
@ 2026-07-24 11:22 ` Sasha Levin
2 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2026-07-24 11:22 UTC (permalink / raw)
To: stable
Cc: Sasha Levin, daniel, info, ast, lulie, john.fastabend, andrii,
martin.lau, song, yonghong.song, kpsingh, sdf, haoluo, jolsa, bpf,
linux-kernel, mykolal, shuah, linux-kselftest, dust.li
> Backport of the CVE-2026-53090 fix.
>
> 1/2 ee861486e377, the CVE fix.
> 2/2 e0fcb42bc6f4, selftests for the fix.
Queued the series for 6.6, 6.12, and 6.18, thanks.
One follow-up: the Fixes commit 09b28d76eac4 ("bpf: Add abnormal return
checks.") is also present in 6.1, 5.15 and 5.10, and the fix is absent there,
so those trees are affected as well but were not covered by this submission.
They likely need a further adaptation. Could you extend coverage with adapted
backports for 6.1/5.15/5.10?
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 6+ messages in thread