Patch "bpf: Set run context for rawtp test_run callback" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf: Set run context for rawtp test_run callback

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-set-run-context-for-rawtp-test_run-callback.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 16792e4767e068eb6bdcbe4aa1378f9c556bf2bc
Author: Jiri Olsa <jolsa@xxxxxxxxxx>
Date:   Tue Jun 4 17:00:24 2024 +0200

    bpf: Set run context for rawtp test_run callback
    
    [ Upstream commit d0d1df8ba18abc57f28fb3bc053b2bf319367f2c ]
    
    syzbot reported crash when rawtp program executed through the
    test_run interface calls bpf_get_attach_cookie helper or any
    other helper that touches task->bpf_ctx pointer.
    
    Setting the run context (task->bpf_ctx pointer) for test_run
    callback.
    
    Fixes: 7adfc6c9b315 ("bpf: Add bpf_get_attach_cookie() BPF helper to access bpf_cookie value")
    Reported-by: syzbot+3ab78ff125b7979e45f9@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
    Signed-off-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Closes: https://syzkaller.appspot.com/bug?extid=3ab78ff125b7979e45f9
    Link: https://lore.kernel.org/bpf/20240604150024.359247-1-jolsa@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 478ee7aba85f3..12a2934b28ffb 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -707,10 +707,16 @@ static void
 __bpf_prog_test_run_raw_tp(void *data)
 {
 	struct bpf_raw_tp_test_run_info *info = data;
+	struct bpf_trace_run_ctx run_ctx = {};
+	struct bpf_run_ctx *old_run_ctx;
+
+	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
 
 	rcu_read_lock();
 	info->retval = bpf_prog_run(info->prog, info->ctx);
 	rcu_read_unlock();
+
+	bpf_reset_run_ctx(old_run_ctx);
 }
 
 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux