From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BAE0733D6E1 for ; Thu, 11 Jun 2026 04:33:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781152416; cv=none; b=p1yA5/AWGgjyQ6aVIiKu+MGEBuXh4sMfYsmEpfYXReipgZgudeOXQaos8qyZBrb7Rnue2EzdoAIwJIghko4uZUG0fkwCyrbvEexLOIIXGaxX2pjBw/E5N/1VPsuKusSHL9AKk9RsG3jGif3roy2TOBX8FNWH6xH4KK2PkVx35xY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781152416; c=relaxed/simple; bh=/W0U/udYLncDv9LsEfSV4QGDZWt1TafOfr/YSKBgyfQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=WC1JSFGW8ufu7N/D1PXg9XCP/Xhw7650ms1LajKKnF5z2aTN+Ukwr7geCVuVuR6CLldgJPNWTxpaDO7vQxJBCYEUaOrvMTU9sKglxHJqBj96in+86YN4SrgOHdjBqM6ZsCzLas0EfANgjOlIhhlu4FQc4VOaxInQppX/sn38fwI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KvPrFEqj; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KvPrFEqj" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2bf18c30bb2so55827545ad.0 for ; Wed, 10 Jun 2026 21:33:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781152414; x=1781757214; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=HGo2CfD8GEYYcXOuR9CaVUNmMurmqTJup52Dqz8uepE=; b=KvPrFEqjj+TPQabGu8WNhyIlKLuMKw/GRmjnCWxlNMLCTAUPH+GmA5l4u/rKAco7rM 00zRwDV3YDn5Pq+8oVfL5I4E7O/IQi4DZORcCEJ3x0OomQDH0AQLhBirjDP+suOhusJu bRJV8BtWSLFKtOIJ2k2zM8qs9sOgv+TADOBgOBigHNMPgf30zEMHa2gxRGAuL/iq504m r02qk/6EWaTKCw9X7QbvjNbnwCYMhO/9xwZpkxAJeTaswStr0w103t5+4fHcz9atlIcZ tSuR25wwKNprP2cBkkSasaBv0SJOqeyqSQK0v7qVXn6mJPikDViwvhnMcuxhpUn+ZjvZ 1DoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781152414; x=1781757214; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=HGo2CfD8GEYYcXOuR9CaVUNmMurmqTJup52Dqz8uepE=; b=WhldKoIh8cd1v/MqxsOz160yi5Q2rS74aiSVRNpfrApFcsgBS/5+lcR0JND3No68bv NqGwaO7iLEU51PCxjigJZt/tynOsbBNE6AZii0YdYWCRCB54dvlUjFcPnT+wlwh9O6e9 9QMOe2znuCLMt24FdpPO9C7HNPzO/faHcZUP+VXppI93uBmf6JtszinIh/poG/1KaBIR mMPX/L9weYphgNQ6K1dakPYR2x2e07kKxmZsiqqHY4C156fdpH2KsRuym9U+zl8rmU8E NBuN8jFziXvS0Hktx3dVtuTa51X0j6PrHOqow/xFnSrMcPfB+uRJDvks1UqSkh79aTH8 TOuQ== X-Forwarded-Encrypted: i=1; AFNElJ8B2wEi9YHaN0eLvW3Yf0BtFSsrg9KtDnVNpdqUO3854xOMMjvTwHVZ1EG3tZfPJgZVP9NVMIoOlRZmJM8=@vger.kernel.org X-Gm-Message-State: AOJu0YzimFPKqlcwMAgFMaQhrlu4qR1P2PPF7pTYPCo3NM7OawD7c2hU XqAilgxXjGGSpiVestmDEOv31FEzq29vWEyep/GF7jUSMhIrTvZ3yfaX X-Gm-Gg: Acq92OGBjB3zfQClsZmNwUr1YXPstUh3m4Q0GRKs1zzOtFSBdRJ8+MjGZAgjPgcsEIN yFTAf9d4o1lkv4BzrAN5t9ne1tLwKQnYbzKJJL1oSRO2eUbUZHSchxmQtiivb+KbGTvmbLLXSTo fBo2Q5jGDETWgPj23wzAHFpoY9pABDCZ2UOXin8JE/gdfQUeD2TFc0zLvd898gGDesVGDXtbFVo SDFEm5HaXGrkYyrd5BhQ2Q6xGNT5YWAUs0ONqURcQkqUBNUpb4gHUUpjk/mTYw4m5ULslJ+Oivz Sm9NHaqNTWON9Zaq4gDrdKS5fxgFpSBGYNB3pyiIXtNYjYZ6C7FsdMCaQ5fv1soV+DtQ/GTEIno Q/j/XaI59qQxEczeqvn+uWQvpdH1fGv6YeouLTsR0CGM/kgaX4Uk8DhIrKwvh3dGpBwjF79zKZY ClJtDd56QtDvRv+tALyFv47y7kKR2lRCvziEWJO85JNXJtou+y2YoatYjmSxyK+C5aS5CyEimQa 8g2CjhcbO+aaepNnnWYGgmCBwzC X-Received: by 2002:a17:903:acd:b0:2c1:f29a:b554 with SMTP id d9443c01a7336-2c2f21a11f5mr12091875ad.21.1781152414032; Wed, 10 Jun 2026 21:33:34 -0700 (PDT) Received: from u2404-VMware-Virtual-Platform.localdomain ([2a12:a304:100::109f]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16609e05fsm270794455ad.54.2026.06.10.21.33.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Jun 2026 21:33:33 -0700 (PDT) From: Sun Jian To: bpf@vger.kernel.org Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev, davem@davemloft.net, kuba@kernel.org, hawk@kernel.org, john.fastabend@gmail.com, sdf@fomichev.me, shuah@kernel.org, jiayuan.chen@linux.dev, toke@redhat.com, menglong.dong@linux.dev, emil@etsalapatis.com, Sun Jian Subject: [PATCH bpf v3 0/2] bpf: Fix generic devmap egress skb sharing Date: Thu, 11 Jun 2026 12:33:15 +0800 Message-ID: <20260611043317.512843-1-sun.jian.kdev@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Generic XDP devmap multi redirect can leave cloned skbs sharing packet data. When a devmap egress program mutates packet data, another destination sharing the same data may observe that mutation. Fix this by making cloned skbs private before running the generic devmap egress program. Add selftest coverage for the last-destination case, where the final destination runs on the original skb while earlier destinations use cloned skbs. --- v3: - Split the kernel fix and selftest into separate patches. - Move the private-copy logic into dev_map_bpf_prog_run_skb(). - Use deterministic DEVMAP_HASH keys in the last-destination selftest. - Fix the Fixes tag. v2: https://lore.kernel.org/bpf/08c35c70-a59e-4e0e-91db-22b5ec30b611@linux.dev/T/#m613671b243e8651c47f84bb329f0ea668974c549 - Move the private-copy step into dev_map_generic_redirect() so the last-destination path is covered as well. - Use skb_copy() instead of skb_unshare() to keep caller ownership unchanged on allocation failure. - Add a generic XDP last-destination selftest case. v1: https://lore.kernel.org/bpf/CABFUUZFimdrZdq=NWi+N-0sJZWvMwY=f4iF6-3TVMS8=m07Zmw@mail.gmail.com/ Sun Jian (2): bpf: Run generic devmap egress prog on private skb selftests/bpf: Cover generic devmap egress last-dst rewrite kernel/bpf/devmap.c | 21 ++- .../selftests/bpf/prog_tests/test_xdp_veth.c | 152 +++++++++++++++++- 2 files changed, 168 insertions(+), 5 deletions(-) base-commit: e7ae89a0c97ce2b68b0983cd01eda67cf373517d -- 2.43.0