Skip to content

[Deepin-Kernel-SIG] [linux 6.6.y] bpf: fix recent three come up with bugs from upstream #1513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
opsiff merged 3 commits into from
Feb 27, 2026
Merged

[Deepin-Kernel-SIG] [linux 6.6.y] bpf: fix recent three come up with bugs from upstream #1513

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3686bdd
bpf, test_run: Fix user-memory-access vulnerability for LIVE_FRAMES
mannkafai Jan 4, 2026
770e101
bpf: fix null ptr access caused by bpf_prog_test_run_skb
xu-lang Feb 5, 2026
5e1d1b3
bpf: fix: Race condition in bpf_trampoline_unlink_cgroup_shim
xu-lang Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions kernel/bpf/trampoline.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,10 +701,8 @@ int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog,
mutex_lock(&tr->mutex);

shim_link = cgroup_shim_find(tr, bpf_func);
if (shim_link) {
if (shim_link && atomic64_inc_not_zero(&shim_link->link.link.refcnt)) {
/* Reusing existing shim attached by the other program. */
bpf_link_inc(&shim_link->link.link);

mutex_unlock(&tr->mutex);
bpf_trampoline_put(tr); /* bpf_trampoline_get above */
return 0;
Expand Down
23 changes: 11 additions & 12 deletions net/bpf/test_run.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,11 +100,9 @@ static bool bpf_test_timer_continue(struct bpf_test_timer *t, int iterations,
struct xdp_page_head {
struct xdp_buff orig_ctx;
struct xdp_buff ctx;
union {
/* ::data_hard_start starts here */
DECLARE_FLEX_ARRAY(struct xdp_frame, frame);
DECLARE_FLEX_ARRAY(u8, data);
};
/* ::data_hard_start starts here */
struct xdp_frame frame;
DECLARE_FLEX_ARRAY(u8, data);
};

struct xdp_test_data {
Expand Down Expand Up @@ -140,10 +138,11 @@ static void xdp_test_run_init_page(struct page *page, void *arg)
frm_len = orig_ctx->data_end - orig_ctx->data_meta;
meta_len = orig_ctx->data - orig_ctx->data_meta;
headroom -= meta_len;
headroom += sizeof(head->frame);

new_ctx = &head->ctx;
frm = head->frame;
data = head->data;
frm = &head->frame;
data = frm;
memcpy(data + headroom, orig_ctx->data_meta, frm_len);

xdp_init_buff(new_ctx, TEST_XDP_FRAME_SIZE, &xdp->rxq);
Expand Down Expand Up @@ -224,8 +223,8 @@ static bool frame_was_changed(const struct xdp_page_head *head)
* i.e. has the highest chances to be overwritten. If those two are
* untouched, it's most likely safe to skip the context reset.
*/
return head->frame->data != head->orig_ctx.data ||
head->frame->flags != head->orig_ctx.flags;
return head->frame.data != head->orig_ctx.data ||
head->frame.flags != head->orig_ctx.flags;
}

static bool ctx_was_changed(struct xdp_page_head *head)
Expand All @@ -243,8 +242,8 @@ static void reset_ctx(struct xdp_page_head *head)
head->ctx.data = head->orig_ctx.data;
head->ctx.data_meta = head->orig_ctx.data_meta;
head->ctx.data_end = head->orig_ctx.data_end;
xdp_update_frame_from_buff(&head->ctx, head->frame);
head->frame->mem = head->orig_ctx.rxq->mem;
xdp_update_frame_from_buff(&head->ctx, &head->frame);
head->frame.mem = head->orig_ctx.rxq->mem;
}

static int xdp_recv_frames(struct xdp_frame **frames, int nframes,
Expand Down Expand Up @@ -306,7 +305,7 @@ static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog,
head = phys_to_virt(page_to_phys(page));
reset_ctx(head);
ctx = &head->ctx;
frm = head->frame;
frm = &head->frame;
xdp->frame_cnt++;

act = bpf_prog_run_xdp(prog, ctx);
Expand Down
5 changes: 4 additions & 1 deletion net/core/lwt_bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -613,9 +613,12 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)

if (ingress)
err = skb_cow_head(skb, len + skb->mac_len);
else
else {
if (unlikely(!skb_dst(skb)))
return -EINVAL;
err = skb_cow_head(skb,
len + LL_RESERVED_SPACE(skb_dst(skb)->dev));
}
if (unlikely(err))
return err;

Expand Down
6 changes: 3 additions & 3 deletions tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,12 +58,12 @@ static int attach_tc_prog(struct bpf_tc_hook *hook, int fd)

/* The maximum permissible size is: PAGE_SIZE - sizeof(struct xdp_page_head) -
* SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) - XDP_PACKET_HEADROOM =
* 3408 bytes for 64-byte cacheline and 3216 for 256-byte one.
* 3368 bytes for 64-byte cacheline and 3216 for 256-byte one.
Copy link

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment documents the 256-byte cacheline limit as 3216 bytes, but __s390x__ now defines MAX_PKT_SIZE as 3176. Please update the comment so the documented limits match the actual constants (or adjust the constant if 3216 is still intended).

Suggested change
* 3368 bytes for 64-byte cacheline and 3216 for 256-byte one.
* 3368 bytes for 64-byte cacheline and 3176 for 256-byte one.

Copilot uses AI. Check for mistakes.
*/
#if defined(__s390x__)
#define MAX_PKT_SIZE 3216
#define MAX_PKT_SIZE 3176
#else
#define MAX_PKT_SIZE 3408
#define MAX_PKT_SIZE 3368
#endif
static void test_max_pkt_size(int fd)
{
Expand Down