Patch "netkit: Assign missing bpf_net_context" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netkit: Assign missing bpf_net_context

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netkit-assign-missing-bpf_net_context.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fa92c76ea862fe9c09e9eeff9a5d24eac885f46d
Author: Breno Leitao <leitao@xxxxxxxxxx>
Date:   Thu Sep 12 08:56:19 2024 -0700

    netkit: Assign missing bpf_net_context
    
    [ Upstream commit 157f29152b61ca41809dd7ead29f5733adeced19 ]
    
    During the introduction of struct bpf_net_context handling for
    XDP-redirect, the netkit driver has been missed, which also requires it
    because NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the
    per-CPU variables. Otherwise we see the following crash:
    
            BUG: kernel NULL pointer dereference, address: 0000000000000038
            bpf_redirect()
            netkit_xmit()
            dev_hard_start_xmit()
    
    Set the bpf_net_context before invoking netkit_xmit() program within the
    netkit driver.
    
    Fixes: 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.")
    Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
    Acked-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Reviewed-by: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
    Reviewed-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
    Acked-by: Nikolay Aleksandrov <razor@xxxxxxxxxxxxx>
    Acked-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Link: https://patch.msgid.link/20240912155620.1334587-1-leitao@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/netkit.c b/drivers/net/netkit.c
index 16789cd446e9e..3f4187102e773 100644
--- a/drivers/net/netkit.c
+++ b/drivers/net/netkit.c
@@ -65,6 +65,7 @@ static struct netkit *netkit_priv(const struct net_device *dev)
 
 static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+	struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
 	struct netkit *nk = netkit_priv(dev);
 	enum netkit_action ret = READ_ONCE(nk->policy);
 	netdev_tx_t ret_dev = NET_XMIT_SUCCESS;
@@ -72,6 +73,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)
 	struct net_device *peer;
 	int len = skb->len;
 
+	bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
 	rcu_read_lock();
 	peer = rcu_dereference(nk->peer);
 	if (unlikely(!peer || !(peer->flags & IFF_UP) ||
@@ -110,6 +112,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)
 		break;
 	}
 	rcu_read_unlock();
+	bpf_net_ctx_clear(bpf_net_ctx);
 	return ret_dev;
 }