Patch "bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init" has been added to the 6.5-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-avoid-dummy-bpf_offload_netdev-in-__bpf_prog_dev.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8bc0eb464185d6cc5586cb97367da894324561be
Author: Eduard Zingerman <eddyz87@xxxxxxxxx>
Date:   Tue Sep 12 03:55:37 2023 +0300

    bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init
    
    [ Upstream commit 1a49f4195d3498fe458a7f5ff7ec5385da70d92e ]
    
    Fix for a bug observable under the following sequence of events:
    1. Create a network device that does not support XDP offload.
    2. Load a device bound XDP program with BPF_F_XDP_DEV_BOUND_ONLY flag
       (such programs are not offloaded).
    3. Load a device bound XDP program with zero flags
       (such programs are offloaded).
    
    At step (2) __bpf_prog_dev_bound_init() associates with device (1)
    a dummy bpf_offload_netdev struct with .offdev field set to NULL.
    At step (3) __bpf_prog_dev_bound_init() would reuse dummy struct
    allocated at step (2).
    However, downstream usage of the bpf_offload_netdev assumes that
    .offdev field can't be NULL, e.g. in bpf_prog_offload_verifier_prep().
    
    Adjust __bpf_prog_dev_bound_init() to require bpf_offload_netdev
    with non-NULL .offdev for offloaded BPF programs.
    
    Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
    Reported-by: syzbot+291100dcb32190ec02a8@xxxxxxxxxxxxxxxxxxxxxxxxx
    Closes: https://lore.kernel.org/bpf/000000000000d97f3c060479c4f8@xxxxxxxxxx/
    Signed-off-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230912005539.2248244-2-eddyz87@xxxxxxxxx
    Signed-off-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index 8a26cd8814c1b..e842229123ffc 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -198,12 +198,14 @@ static int __bpf_prog_dev_bound_init(struct bpf_prog *prog, struct net_device *n
 	offload->netdev = netdev;
 
 	ondev = bpf_offload_find_netdev(offload->netdev);
+	/* When program is offloaded require presence of "true"
+	 * bpf_offload_netdev, avoid the one created for !ondev case below.
+	 */
+	if (bpf_prog_is_offloaded(prog->aux) && (!ondev || !ondev->offdev)) {
+		err = -EINVAL;
+		goto err_free;
+	}
 	if (!ondev) {
-		if (bpf_prog_is_offloaded(prog->aux)) {
-			err = -EINVAL;
-			goto err_free;
-		}
-
 		/* When only binding to the device, explicitly
 		 * create an entry in the hashtable.
 		 */