Patch "net: xdp: Disallow attaching device-bound programs in generic mode" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: xdp: Disallow attaching device-bound programs in generic mode

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-xdp-disallow-attaching-device-bound-programs-in-.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit df6ed505cf8b68989cb8f1cad0a49387a4434ca1
Author: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
Date:   Mon Jan 27 14:13:42 2025 +0100

    net: xdp: Disallow attaching device-bound programs in generic mode
    
    [ Upstream commit 3595599fa8360bb3c7afa7ee50c810b4a64106ea ]
    
    Device-bound programs are used to support RX metadata kfuncs. These
    kfuncs are driver-specific and rely on the driver context to read the
    metadata. This means they can't work in generic XDP mode. However, there
    is no check to disallow such programs from being attached in generic
    mode, in which case the metadata kfuncs will be called in an invalid
    context, leading to crashes.
    
    Fix this by adding a check to disallow attaching device-bound programs
    in generic mode.
    
    Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
    Reported-by: Marcus Wichelmann <marcus.wichelmann@xxxxxxxxxxxxxxxx>
    Closes: https://lore.kernel.org/r/dae862ec-43b5-41a0-8edf-46c59071cdda@xxxxxxxxxxxxxxxx
    Tested-by: Marcus Wichelmann <marcus.wichelmann@xxxxxxxxxxxxxxxx>
    Acked-by: Stanislav Fomichev <sdf@xxxxxxxxxxx>
    Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
    Acked-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Link: https://patch.msgid.link/20250127131344.238147-1-toke@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/dev.c b/net/core/dev.c
index 7c3e2a448e5c6..2e0fe38d0e877 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -9595,6 +9595,10 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack
 			NL_SET_ERR_MSG(extack, "Program bound to different device");
 			return -EINVAL;
 		}
+		if (bpf_prog_is_dev_bound(new_prog->aux) && mode == XDP_MODE_SKB) {
+			NL_SET_ERR_MSG(extack, "Can't attach device-bound programs in generic mode");
+			return -EINVAL;
+		}
 		if (new_prog->expected_attach_type == BPF_XDP_DEVMAP) {
 			NL_SET_ERR_MSG(extack, "BPF_XDP_DEVMAP programs can not be attached to a device");
 			return -EINVAL;