Generic XDP devmap multi redirect can leave cloned skbs sharing packet data. When a devmap egress program mutates packet data, another destination sharing the same data may observe that mutation.
Fix this by making cloned skbs private before running the generic devmap egress program. Add selftest coverage for the last-destination case, where the final destination runs on the original skb while earlier destinations use cloned skbs. --- v3: - Split the kernel fix and selftest into separate patches. - Move the private-copy logic into dev_map_bpf_prog_run_skb(). - Use deterministic DEVMAP_HASH keys in the last-destination selftest. - Fix the Fixes tag. v2: https://lore.kernel.org/bpf/[email protected]/T/#m613671b243e8651c47f84bb329f0ea668974c549 - Move the private-copy step into dev_map_generic_redirect() so the last-destination path is covered as well. - Use skb_copy() instead of skb_unshare() to keep caller ownership unchanged on allocation failure. - Add a generic XDP last-destination selftest case. v1: https://lore.kernel.org/bpf/CABFUUZFimdrZdq=NWi+N-0sJZWvMwY=f4iF6-3TVMS8=m07...@mail.gmail.com/ Sun Jian (2): bpf: Run generic devmap egress prog on private skb selftests/bpf: Cover generic devmap egress last-dst rewrite kernel/bpf/devmap.c | 21 ++- .../selftests/bpf/prog_tests/test_xdp_veth.c | 152 +++++++++++++++++- 2 files changed, 168 insertions(+), 5 deletions(-) base-commit: e7ae89a0c97ce2b68b0983cd01eda67cf373517d -- 2.43.0
