This is a note to let you know that I've just added the patch titled
selftests/bpf: Check dst_port only on the client socket
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
selftests-bpf-check-dst_port-only-on-the-client-socket.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Wed Aug 3 02:01:59 PM CEST 2022
From: Ovidiu Panait <ovidiu.panait@xxxxxxxxxxxxx>
Date: Mon, 1 Aug 2022 17:48:51 +0300
Subject: selftests/bpf: Check dst_port only on the client socket
To: stable@xxxxxxxxxxxxxxx
Cc: Jakub Sitnicki <jakub@xxxxxxxxxxxxxx>, Daniel Borkmann <daniel@xxxxxxxxxxxxx>, Martin KaFai Lau <kafai@xxxxxx>, Ovidiu Panait <ovidiu.panait@xxxxxxxxxxxxx>
Message-ID: <20220801144851.1924122-2-ovidiu.panait@xxxxxxxxxxxxx>
From: Jakub Sitnicki <jakub@xxxxxxxxxxxxxx>
commit 2d2202ba858c112b03f84d546e260c61425831a1 upstream.
cgroup_skb/egress programs which sock_fields test installs process packets
flying in both directions, from the client to the server, and in reverse
direction.
Recently added dst_port check relies on the fact that destination
port (remote peer port) of the socket which sends the packet is known ahead
of time. This holds true only for the client socket, which connects to the
known server port.
Filter out any traffic that is not egressing from the client socket in the
BPF program that tests reading the dst_port.
Fixes: 8f50f16ff39d ("selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads")
Signed-off-by: Jakub Sitnicki <jakub@xxxxxxxxxxxxxx>
Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Acked-by: Martin KaFai Lau <kafai@xxxxxx>
Link: https://lore.kernel.org/bpf/20220317113920.1068535-3-jakub@xxxxxxxxxxxxxx
Signed-off-by: Ovidiu Panait <ovidiu.panait@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
tools/testing/selftests/bpf/progs/test_sock_fields.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/tools/testing/selftests/bpf/progs/test_sock_fields.c
+++ b/tools/testing/selftests/bpf/progs/test_sock_fields.c
@@ -281,6 +281,10 @@ int read_sk_dst_port(struct __sk_buff *s
if (!sk)
RET_LOG();
+ /* Ignore everything but the SYN from the client socket */
+ if (sk->state != BPF_TCP_SYN_SENT)
+ return CG_OK;
+
if (!sk_dst_port__load_word(sk))
RET_LOG();
if (!sk_dst_port__load_half(sk))
Patches currently in stable-queue which might be from ovidiu.panait@xxxxxxxxxxxxx are
queue-5.15/selftests-bpf-check-dst_port-only-on-the-client-socket.patch
queue-5.15/selftests-bpf-extend-verifier-and-bpf_sock-tests-for-dst_port-loads.patch
