From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj2-f12.google.com (mail-pj2-f12.google.com [74.125.227.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53F1745D93E for ; Sun, 20 Sep 2026 16:32:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.140 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789921975; cv=none; b=YOyAUCwMd+zLXrQam1+FC2QAqg0WJfiJetXLScsO8vMCnCI7rPf4ZRH47ZD/eqH0dshEsYci1+gkX8rK3iJp2gk22sum96S5ZnRYy1N5Fr1VWCW7sHjzwf1xtOX+Az7LxOgg9VFA5hlV1QCNE9xFIlBpmb5sZiP2a6zkQVPi498= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789921975; c=relaxed/simple; bh=ISMr9k/4ayfp7cIsuOtuFI3mL3SoCez2K155WDMQWyU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rGHvwgoxDbDH9ZF4l4ZgsBhxs8WiYRETiW/mV2hSikX9JCgOqolhBKcM8k5XjV6XSykn/TBfn3S0toYKf/PJuJ7//qRrMXdQvtXAQubwrmh7wj2OIhaCpczwVXDumNUwGW9kGFOWVH9m9MPb/5LH85UTg0AjhmkK860OOG5Rv5g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SB4EHrZy; arc=none smtp.client-ip=74.125.227.140 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SB4EHrZy" Received: by mail-pj2-f12.google.com with SMTP id d9443c01a7336-2db1ca069c8so22610975ad.3 for ; Sun, 20 Sep 2026 09:32:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789921971; x=1790526771; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VxrYw5XYqojCDttriJ4CNjE+Rxifl6ZmijYb7xfnw6E=; b=SB4EHrZydpEUlLfwAIrxMb/vSHzMILHeky8mJrePffr9xV/4uoNxd0IcWezRAtp6aI mp2KK8qQ6ud98djfGG8C2EpEDn2Dq2ClxMhmEb/NdpaZvjFw1SDgbtx5b6NiaM1ma7Q1 YthFBhKJd9H7GrInfl4D6n0raeu89h7pOdGeQ2yhAi+yYxZ30f+QEaNwJH96gKBb9UeG izxgqDA+eu/plJfl9VPUI+GCCjJ4xK5Xtg9Gn+SrkELJSLDtrNYvXMRqwu8avXrpyFCi 2urqYrT2e6/hkyjk7nu3j9t3N7n8HiYVKD+AksT6BMz15d8N05wbQtrn/5CDNtx+UgiQ NMjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789921971; x=1790526771; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=VxrYw5XYqojCDttriJ4CNjE+Rxifl6ZmijYb7xfnw6E=; b=mI58bGJFu9dEedFGrju6sU3I8jub6fotK5dC/6tDv1fbos3FZU71/c7xPCFgcVvU9c 8swYnizWHLAcmJjrIFAxfKo6vMk+1mGZjCkuQ9alkegPgLdSljXePNVTyBwahooniYAC RTlv3Wh6I4R6Z4mbb+yDzxsjav93NnuZefPjLWUXaKBmr8mc7W/xZmYdKmzPZralN5Sr nPBM5LuBm0zrGkF7r4FwnOtuOr2sqCNI8HlJ663oKEnQ5x9jzBFHN/aFC7vHbaNJ9bIC erOBu0GqH2ElTC49yHrzVLaCK7j83DyAlESi0TASUJIZlwDCqnZYOpovg5eDroNzQfCS ZIOg== X-Gm-Message-State: AFuF++ld+FFvGs8QJLCXYGjOACjJoBStlecCOf+kAbGKS8pPXSM4MxMk q0UCRBDr5PeXGBBhKsnbO2g21nXx3KsUxQ2RpD/f+Y8Ss9tI7eGP6z0D X-Gm-Gg: AYBFou0WLc55KdAyK1swO9IGFok6Y4fc1VxnYVfT73CuaKLQwRT5ZibFXVJUr3pOkV+ hzUsgpOW228N3tpsj+4sr84JeTTARfkd7SSylE76d7bS00jKolgvnORqvqleMB87AdPiH2VSYld HXJJznjV6Fvi5yjFyF4guZGcdcE3dnp4XKueZmKIHSbcj4cGPaGfVJCapHUnM2vhS2yBeGaeVB9 ou6Zxxc5xnIFz7WeLhsjd8/eWFhUaBJg6sA41zcgH54rlGOEg2AQZjJ14qmnrNuz7rtfW7mXvmj dfAmVvoAy7W566n7fEfuh03ep2AY0VpZTSu63tuz1Iyd5lSMyX+znpaBp5UTgo6GOm0xvvxqSZA 8yV39spa2wM55JSth+UdpwU+WqbxFZpf9IZH+HtLFYWqEszxecRvRk5TJOxjFNua3QF87eo0nWi I6VACjDuHMKJe9DdzCnbLarQGuwh9BjBDCDd5vw8GA9u/lLef78or2J0sCCffFM/ulbpuitDtGx 2sX8T/lFEvZRKvk3+yqHU6cruec02V+ X-Received: by 2002:a17:903:380d:b0:2dd:c100:b2ce with SMTP id d9443c01a7336-2ddc100b384mr67923315ad.57.1789921970736; Sun, 20 Sep 2026 09:32:50 -0700 (PDT) Received: from 192.168.50.3 ([198.176.50.208]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ddc17e17e0sm21784355ad.70.2026.09.20.09.32.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 20 Sep 2026 09:32:49 -0700 (PDT) From: Weiming Shi To: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Shuah Khan Cc: linux-kernel@vger.kernel.org, bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Peter Oskolkov , Xiang Mei , stable@vger.kernel.org Subject: [PATCH v3 1/3] bpf: propagate cb_access from freplace programs Date: Mon, 21 Sep 2026 00:32:09 +0800 Message-ID: <20260920163211.795547-2-bestswngs@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260920163211.795547-1-bestswngs@gmail.com> References: <20260920163211.795547-1-bestswngs@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit bpf_prog_run_save_cb() and bpf_prog_run_clear_cb() use the target program's cb_access flag to decide whether skb->cb must be saved or cleared. An extension program can introduce ctx->cb[] access behind a target which does not access it itself, leaving protocol-owned control block contents visible to the replacement and preventing the wrapper from restoring them. Make cb_access independently addressable and propagate it to the target before activating a replacement. Wait for wrappers which observed the old value, and snapshot the flag once per invocation so save and restore decisions remain paired. Cc: stable@vger.kernel.org Fixes: be8704ff07d2 ("bpf: Introduce dynamic program extensions") Suggested-by: Daniel Borkmann Assisted-by: LLM Signed-off-by: Weiming Shi --- include/linux/bpf.h | 2 +- include/linux/filter.h | 7 ++++--- kernel/bpf/syscall.c | 6 ++++++ 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index e57af902560c3..606e7cf397af2 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1864,11 +1864,11 @@ struct bpf_prog_aux { struct bpf_prog { u16 pages; /* Number of allocated pages */ + bool cb_access; /* Is control block accessed? */ u32 jited:1, /* Is our filter JIT'ed? */ jit_requested:1,/* archs need to JIT the prog */ jit_required:1, /* program strictly requires JIT compiler */ gpl_compatible:1, /* Is filter GPL compatible? */ - cb_access:1, /* Is control block accessed? */ dst_needed:1, /* Do we need dst entry? */ blinding_requested:1, /* needs constant blinding */ blinded:1, /* Was blinded */ diff --git a/include/linux/filter.h b/include/linux/filter.h index 39decde7fc730..788c2d625db4a 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1047,16 +1047,17 @@ static inline u32 __bpf_prog_run_save_cb(const struct bpf_prog *prog, const struct sk_buff *skb = ctx; u8 *cb_data = bpf_skb_cb(skb); u8 cb_saved[BPF_SKB_CB_LEN]; + bool cb_access = READ_ONCE(prog->cb_access); u32 res; - if (unlikely(prog->cb_access)) { + if (unlikely(cb_access)) { memcpy(cb_saved, cb_data, sizeof(cb_saved)); memset(cb_data, 0, sizeof(cb_saved)); } res = bpf_prog_run(prog, skb); - if (unlikely(prog->cb_access)) + if (unlikely(cb_access)) memcpy(cb_data, cb_saved, sizeof(cb_saved)); return res; @@ -1079,7 +1080,7 @@ static inline u32 bpf_prog_run_clear_cb(const struct bpf_prog *prog, u8 *cb_data = bpf_skb_cb(skb); u32 res; - if (unlikely(prog->cb_access)) + if (unlikely(READ_ONCE(prog->cb_access))) memset(cb_data, 0, BPF_SKB_CB_LEN); res = bpf_prog_run_pin_on_cpu(prog, skb); diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index c7bc9ba9b331f..43a29e47c8d01 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -3812,6 +3812,12 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, if (err) goto out_unlock; + if (prog->type == BPF_PROG_TYPE_EXT && READ_ONCE(prog->cb_access)) { + WRITE_ONCE(tgt_prog->cb_access, true); + /* Drain runs that observed cb_access=false before enabling freplace. */ + synchronize_rcu(); + } + err = bpf_trampoline_link_prog(&link->link.node, tr, tgt_prog); if (err) { bpf_link_cleanup(&link_primer); -- 2.55.0