Skip to content

Conversation

@kernel-patches-daemon-bpf
Copy link

Pull request for series with
subject: bpf: add bpf_prog_run_data_pointers()
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 026bcf9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 3249e8a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: f1d8c65
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: f1d8c65
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 93ce3be
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489
version: 1

syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().

WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214

struct tc_skb_cb has been added in commit ec624fe ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba4 ("bpf: wire in data and data_end for
cls_act_bpf").

drop_reason was added later.

Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.

Fixes: ec624fe ("net/sched: Extend qdisc control block with tc control block")
Reported-by: syzbot <[email protected]>
Closes: https://lore.kernel.org/netdev/[email protected]/
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Paul Blakey <[email protected]>
Reviewed-by: Victor Nogueira <[email protected]>
Acked-by: Jamal Hadi Salim <[email protected]>
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 93ce3be
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=1022489 irrelevant now. Closing PR.

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot deleted the series/1022489=>bpf-next branch November 14, 2025 17:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants