Patch "net: xdp: Disallow attaching device-bound programs in generic mode" has been added to the 6.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: xdp: Disallow attaching device-bound programs in generic mode

to the 6.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-xdp-disallow-attaching-device-bound-programs-in-.patch
and it can be found in the queue-6.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 396ef3d6dc55c3738c00572beed1f1a571a93022
Author: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
Date:   Mon Jan 27 14:13:42 2025 +0100

    net: xdp: Disallow attaching device-bound programs in generic mode
    
    [ Upstream commit 3595599fa8360bb3c7afa7ee50c810b4a64106ea ]
    
    Device-bound programs are used to support RX metadata kfuncs. These
    kfuncs are driver-specific and rely on the driver context to read the
    metadata. This means they can't work in generic XDP mode. However, there
    is no check to disallow such programs from being attached in generic
    mode, in which case the metadata kfuncs will be called in an invalid
    context, leading to crashes.
    
    Fix this by adding a check to disallow attaching device-bound programs
    in generic mode.
    
    Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
    Reported-by: Marcus Wichelmann <marcus.wichelmann@xxxxxxxxxxxxxxxx>
    Closes: https://lore.kernel.org/r/dae862ec-43b5-41a0-8edf-46c59071cdda@xxxxxxxxxxxxxxxx
    Tested-by: Marcus Wichelmann <marcus.wichelmann@xxxxxxxxxxxxxxxx>
    Acked-by: Stanislav Fomichev <sdf@xxxxxxxxxxx>
    Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
    Acked-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Link: https://patch.msgid.link/20250127131344.238147-1-toke@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/dev.c b/net/core/dev.c
index a994b1c725098..fbb796375aa0e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -9699,6 +9699,10 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack
 			NL_SET_ERR_MSG(extack, "Program bound to different device");
 			return -EINVAL;
 		}
+		if (bpf_prog_is_dev_bound(new_prog->aux) && mode == XDP_MODE_SKB) {
+			NL_SET_ERR_MSG(extack, "Can't attach device-bound programs in generic mode");
+			return -EINVAL;
+		}
 		if (new_prog->expected_attach_type == BPF_XDP_DEVMAP) {
 			NL_SET_ERR_MSG(extack, "BPF_XDP_DEVMAP programs can not be attached to a device");
 			return -EINVAL;