Netdev List
 help / color / mirror / Atom feed
* [PATCH bpf v5 0/2] bpf: Fix generic devmap egress skb sharing
@ 2026-06-12 11:40 Sun Jian
  2026-06-12 11:40 ` [PATCH bpf v5 1/2] bpf: Run generic devmap egress prog on private skb Sun Jian
  2026-06-12 11:40 ` [PATCH bpf v5 2/2] selftests/bpf: Cover generic devmap egress last-dst rewrite Sun Jian
  0 siblings, 2 replies; 3+ messages in thread
From: Sun Jian @ 2026-06-12 11:40 UTC (permalink / raw)
  To: bpf
  Cc: netdev, linux-kernel, linux-kselftest, ast, daniel, andrii,
	martin.lau, davem, kuba, hawk, john.fastabend, sdf, shuah,
	jiayuan.chen, toke, menglong.dong, emil, Sun Jian

Generic XDP devmap multi redirect can leave cloned skbs sharing packet
data. When a devmap egress program mutates packet data, another
destination sharing the same data may observe that mutation.

Fix this by making cloned skbs private before running the generic devmap
egress program. The private copy is made in dev_map_generic_redirect()
so dev_map_bpf_prog_run_skb() can keep returning the XDP action directly.

Add selftest coverage for the last-destination case, where the final
destination runs on the original skb while earlier destinations use 
cloned skbs. The test records the source MAC observed by an earlier
destination and checks that it is neither the sentinel value left in the 
result map nor the MAC written by the final destination.

---

v5:
- Move the skb_copy() check back to dev_map_generic_redirect() to keep
  dev_map_bpf_prog_run_skb() returning only the XDP action.
- Preserve mac_len after skb_copy().
- Use __be64 temporary values when updating mac_map from userspace.
- Initialize rx_mac with a sentinel in the last-destination test instead
  of relying on -ENOENT for ARRAY map lookups.
- Adjust the last-destination test topology so the checked earlier
  destination is not the ingress/source veth.
- Split the last-destination check into two assertions: one for store_mac_1
  updating rx_mac and one for detecting last-destination rewrite leakage.

v4: https://lore.kernel.org/bpf/20260611080850.536996-1-sun.jian.kdev@gmail.com/T/#mf830f03d362f33e0941d1b0e425169698fce76e5
- Preserve mac_len after skb_copy().
- Separate errno return from XDP action output in
  dev_map_bpf_prog_run_skb().
- Zero-initialize net_config in the new selftest.

v3: https://lore.kernel.org/bpf/20260611043317.512843-1-sun.jian.kdev@gmail.com/
- Split the kernel fix and selftest into separate patches.
- Move the private-copy logic into dev_map_bpf_prog_run_skb().
- Use deterministic DEVMAP_HASH keys in the last-destination selftest.
- Fix the Fixes tag.

v2: https://lore.kernel.org/bpf/08c35c70-a59e-4e0e-91db-22b5ec30b611@linux.dev/
- Move the private-copy step into dev_map_generic_redirect() so the
  last-destination path is covered as well.
- Use skb_copy() instead of skb_unshare() to keep caller ownership
  unchanged on allocation failure.
- Add a generic XDP last-destination selftest case.

v1: https://lore.kernel.org/bpf/CABFUUZFimdrZdq=NWi+N-0sJZWvMwY=f4iF6-3TVMS8=m07Zmw@mail.gmail.com/

Sun Jian (2):
  bpf: Run generic devmap egress prog on private skb
  selftests/bpf: Cover generic devmap egress last-dst rewrite

 kernel/bpf/devmap.c                           |  12 ++
 .../selftests/bpf/prog_tests/test_xdp_veth.c  | 166 +++++++++++++++++-
 2 files changed, 175 insertions(+), 3 deletions(-)


base-commit: e7ae89a0c97ce2b68b0983cd01eda67cf373517d
-- 
2.43.0


^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-12 11:41 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-12 11:40 [PATCH bpf v5 0/2] bpf: Fix generic devmap egress skb sharing Sun Jian
2026-06-12 11:40 ` [PATCH bpf v5 1/2] bpf: Run generic devmap egress prog on private skb Sun Jian
2026-06-12 11:40 ` [PATCH bpf v5 2/2] selftests/bpf: Cover generic devmap egress last-dst rewrite Sun Jian

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox