[PATCH v3 1/3] bpf: propagate cb_access from freplace programs
From: Weiming Shi <hidden>
Date: 2026-09-20 16:32:53
Also in:
bpf, linux-kselftest, lkml, stable
Subsystem:
bpf [core], bpf [general] (safe dynamic programs and tools), the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, Linus Torvalds
bpf_prog_run_save_cb() and bpf_prog_run_clear_cb() use the target
program's cb_access flag to decide whether skb->cb must be saved or
cleared. An extension program can introduce ctx->cb[] access behind a
target which does not access it itself, leaving protocol-owned control
block contents visible to the replacement and preventing the wrapper
from restoring them.
Make cb_access independently addressable and propagate it to the target
before activating a replacement. Wait for wrappers which observed the
old value, and snapshot the flag once per invocation so save and restore
decisions remain paired.
Cc: stable@vger.kernel.org
Fixes: be8704ff07d2 ("bpf: Introduce dynamic program extensions")
Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Assisted-by: LLM
Signed-off-by: Weiming Shi <redacted>
---
include/linux/bpf.h | 2 +-
include/linux/filter.h | 7 ++++---
kernel/bpf/syscall.c | 6 ++++++
3 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index e57af902560c3..606e7cf397af2 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h@@ -1864,11 +1864,11 @@ struct bpf_prog_aux { struct bpf_prog { u16 pages; /* Number of allocated pages */ + bool cb_access; /* Is control block accessed? */ u32 jited:1, /* Is our filter JIT'ed? */ jit_requested:1,/* archs need to JIT the prog */ jit_required:1, /* program strictly requires JIT compiler */ gpl_compatible:1, /* Is filter GPL compatible? */ - cb_access:1, /* Is control block accessed? */ dst_needed:1, /* Do we need dst entry? */ blinding_requested:1, /* needs constant blinding */ blinded:1, /* Was blinded */
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 39decde7fc730..788c2d625db4a 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h@@ -1047,16 +1047,17 @@ static inline u32 __bpf_prog_run_save_cb(const struct bpf_prog *prog, const struct sk_buff *skb = ctx; u8 *cb_data = bpf_skb_cb(skb); u8 cb_saved[BPF_SKB_CB_LEN]; + bool cb_access = READ_ONCE(prog->cb_access); u32 res; - if (unlikely(prog->cb_access)) { + if (unlikely(cb_access)) { memcpy(cb_saved, cb_data, sizeof(cb_saved)); memset(cb_data, 0, sizeof(cb_saved)); } res = bpf_prog_run(prog, skb); - if (unlikely(prog->cb_access)) + if (unlikely(cb_access)) memcpy(cb_data, cb_saved, sizeof(cb_saved)); return res;
@@ -1079,7 +1080,7 @@ static inline u32 bpf_prog_run_clear_cb(const struct bpf_prog *prog, u8 *cb_data = bpf_skb_cb(skb); u32 res; - if (unlikely(prog->cb_access)) + if (unlikely(READ_ONCE(prog->cb_access))) memset(cb_data, 0, BPF_SKB_CB_LEN); res = bpf_prog_run_pin_on_cpu(prog, skb);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index c7bc9ba9b331f..43a29e47c8d01 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c@@ -3812,6 +3812,12 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, if (err) goto out_unlock; + if (prog->type == BPF_PROG_TYPE_EXT && READ_ONCE(prog->cb_access)) { + WRITE_ONCE(tgt_prog->cb_access, true); + /* Drain runs that observed cb_access=false before enabling freplace. */ + synchronize_rcu(); + } + err = bpf_trampoline_link_prog(&link->link.node, tr, tgt_prog); if (err) { bpf_link_cleanup(&link_primer);
--
2.55.0