Patch "bpf: Fix updating attached freplace prog in prog_array map" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf: Fix updating attached freplace prog in prog_array map

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-updating-attached-freplace-prog-in-prog_arra.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 35d88d9b913922494616be66ffe989db34bb9d64
Author: Leon Hwang <leon.hwang@xxxxxxxxx>
Date:   Sun Jul 28 19:46:11 2024 +0800

    bpf: Fix updating attached freplace prog in prog_array map
    
    [ Upstream commit fdad456cbcca739bae1849549c7a999857c56f88 ]
    
    The commit f7866c358733 ("bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT")
    fixed a NULL pointer dereference panic, but didn't fix the issue that
    fails to update attached freplace prog to prog_array map.
    
    Since commit 1c123c567fb1 ("bpf: Resolve fext program type when checking map compatibility"),
    freplace prog and its target prog are able to tail call each other.
    
    And the commit 3aac1ead5eb6 ("bpf: Move prog->aux->linked_prog and trampoline into bpf_link on attach")
    sets prog->aux->dst_prog as NULL after attaching freplace prog to its
    target prog.
    
    After loading freplace the prog_array's owner type is BPF_PROG_TYPE_SCHED_CLS.
    Then, after attaching freplace its prog->aux->dst_prog is NULL.
    Then, while updating freplace in prog_array the bpf_prog_map_compatible()
    incorrectly returns false because resolve_prog_type() returns
    BPF_PROG_TYPE_EXT instead of BPF_PROG_TYPE_SCHED_CLS.
    After this patch the resolve_prog_type() returns BPF_PROG_TYPE_SCHED_CLS
    and update to prog_array can succeed.
    
    Fixes: f7866c358733 ("bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT")
    Cc: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
    Cc: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Acked-by: Yonghong Song <yonghong.song@xxxxxxxxx>
    Signed-off-by: Leon Hwang <leon.hwang@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240728114612.48486-2-leon.hwang@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index b62535fd8de5f..92919d52f7e1b 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -760,8 +760,8 @@ static inline u32 type_flag(u32 type)
 /* only use after check_attach_btf_id() */
 static inline enum bpf_prog_type resolve_prog_type(const struct bpf_prog *prog)
 {
-	return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->dst_prog) ?
-		prog->aux->dst_prog->type : prog->type;
+	return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->saved_dst_prog_type) ?
+		prog->aux->saved_dst_prog_type : prog->type;
 }
 
 static inline bool bpf_prog_check_recur(const struct bpf_prog *prog)




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux