Patch "bpf: consider that tail calls invalidate packet pointers" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: consider that tail calls invalidate packet pointers

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-consider-that-tail-calls-invalidate-packet-point.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 984bd4a473eda067fa6716a5ee4855564d74aaa4
Author: Eduard Zingerman <eddyz87@xxxxxxxxx>
Date:   Mon Dec 9 20:10:59 2024 -0800

    bpf: consider that tail calls invalidate packet pointers
    
    [ Upstream commit 1a4607ffba35bf2a630aab299e34dd3f6e658d70 ]
    
    Tail-called programs could execute any of the helpers that invalidate
    packet pointers. Hence, conservatively assume that each tail call
    invalidates packet pointers.
    
    Making the change in bpf_helper_changes_pkt_data() automatically makes
    use of check_cfg() logic that computes 'changes_pkt_data' effect for
    global sub-programs, such that the following program could be
    rejected:
    
        int tail_call(struct __sk_buff *sk)
        {
            bpf_tail_call_static(sk, &jmp_table, 0);
            return 0;
        }
    
        SEC("tc")
        int not_safe(struct __sk_buff *sk)
        {
            int *p = (void *)(long)sk->data;
            ... make p valid ...
            tail_call(sk);
            *p = 42; /* this is unsafe */
            ...
        }
    
    The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that
    can invalidate packet pointers. Otherwise, it can't be freplaced with
    tailcall_freplace.c:entry_freplace() that does a tail call.
    
    Signed-off-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20241210041100.1898468-8-eddyz87@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/filter.c b/net/core/filter.c
index 4b0ad74cfff5..54a53fae9e98 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -7943,6 +7943,8 @@ bool bpf_helper_changes_pkt_data(enum bpf_func_id func_id)
 	case BPF_FUNC_xdp_adjust_head:
 	case BPF_FUNC_xdp_adjust_meta:
 	case BPF_FUNC_xdp_adjust_tail:
+	/* tail-called program could call any of the above */
+	case BPF_FUNC_tail_call:
 		return true;
 	default:
 		return false;
diff --git a/tools/testing/selftests/bpf/progs/tc_bpf2bpf.c b/tools/testing/selftests/bpf/progs/tc_bpf2bpf.c
index 8a0632c37839..79f5087dade2 100644
--- a/tools/testing/selftests/bpf/progs/tc_bpf2bpf.c
+++ b/tools/testing/selftests/bpf/progs/tc_bpf2bpf.c
@@ -10,6 +10,8 @@ int subprog(struct __sk_buff *skb)
 	int ret = 1;
 
 	__sink(ret);
+	/* let verifier know that 'subprog_tc' can change pointers to skb->data */
+	bpf_skb_change_proto(skb, 0, 0);
 	return ret;
 }