bpf_prog_run_save_cb() and bpf_prog_run_clear_cb() use the target program's cb_access flag to decide whether skb->cb must be saved or cleared. An extension program can introduce ctx->cb[] access behind a target which does not access it itself, leaving protocol-owned control block contents visible to the replacement and preventing the wrapper from restoring them.
Make cb_access independently addressable and propagate it to the target before activating a replacement. Wait for wrappers which observed the old value, and snapshot the flag once per invocation so save and restore decisions remain paired. Cc: [email protected] Fixes: be8704ff07d2 ("bpf: Introduce dynamic program extensions") Suggested-by: Daniel Borkmann <[email protected]> Assisted-by: LLM Signed-off-by: Weiming Shi <[email protected]> --- include/linux/bpf.h | 2 +- include/linux/filter.h | 7 ++++--- kernel/bpf/syscall.c | 6 ++++++ 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index e57af902560c3..606e7cf397af2 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1864,11 +1864,11 @@ struct bpf_prog_aux { struct bpf_prog { u16 pages; /* Number of allocated pages */ + bool cb_access; /* Is control block accessed? */ u32 jited:1, /* Is our filter JIT'ed? */ jit_requested:1,/* archs need to JIT the prog */ jit_required:1, /* program strictly requires JIT compiler */ gpl_compatible:1, /* Is filter GPL compatible? */ - cb_access:1, /* Is control block accessed? */ dst_needed:1, /* Do we need dst entry? */ blinding_requested:1, /* needs constant blinding */ blinded:1, /* Was blinded */ diff --git a/include/linux/filter.h b/include/linux/filter.h index 39decde7fc730..788c2d625db4a 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1047,16 +1047,17 @@ static inline u32 __bpf_prog_run_save_cb(const struct bpf_prog *prog, const struct sk_buff *skb = ctx; u8 *cb_data = bpf_skb_cb(skb); u8 cb_saved[BPF_SKB_CB_LEN]; + bool cb_access = READ_ONCE(prog->cb_access); u32 res; - if (unlikely(prog->cb_access)) { + if (unlikely(cb_access)) { memcpy(cb_saved, cb_data, sizeof(cb_saved)); memset(cb_data, 0, sizeof(cb_saved)); } res = bpf_prog_run(prog, skb); - if (unlikely(prog->cb_access)) + if (unlikely(cb_access)) memcpy(cb_data, cb_saved, sizeof(cb_saved)); return res; @@ -1079,7 +1080,7 @@ static inline u32 bpf_prog_run_clear_cb(const struct bpf_prog *prog, u8 *cb_data = bpf_skb_cb(skb); u32 res; - if (unlikely(prog->cb_access)) + if (unlikely(READ_ONCE(prog->cb_access))) memset(cb_data, 0, BPF_SKB_CB_LEN); res = bpf_prog_run_pin_on_cpu(prog, skb); diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index c7bc9ba9b331f..43a29e47c8d01 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -3812,6 +3812,12 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, if (err) goto out_unlock; + if (prog->type == BPF_PROG_TYPE_EXT && READ_ONCE(prog->cb_access)) { + WRITE_ONCE(tgt_prog->cb_access, true); + /* Drain runs that observed cb_access=false before enabling freplace. */ + synchronize_rcu(); + } + err = bpf_trampoline_link_prog(&link->link.node, tr, tgt_prog); if (err) { bpf_link_cleanup(&link_primer); -- 2.55.0
