Daniel Borkmann
30f27ca7ab
UPSTREAM: bpf: Fix ringbuf helper function compatibility ...
commit 5b029a32cfe4600f5e10e36b41778506b90fd4de upstream.
Commit 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support
for it") extended check_map_func_compatibility() by enforcing map -> helper
function match, but not helper -> map type match.
Due to this all of the bpf_ringbuf_*() helper functions could be used with
a wrong map type such as array or hash map, leading to invalid access due
to type confusion.
Also, both BPF_FUNC_ringbuf_{submit,discard} have ARG_PTR_TO_ALLOC_MEM as
argument and not a BPF map. Therefore, their check_map_func_compatibility()
presence is incorrect since it's only for map type checking.
Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: Ryota Shiga (Flatt Security)
Change-Id: I5b1693d2aaa1f028f66f485e82cb5a3292917294
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
2026-05-15 17:59:34 +07:00
UPSTREAM: bpf: Simplify __bpf_arch_text_poke poke type handling
2026-05-15 17:59:17 +07:00
BACKPORT: bpf: Fix 32 bit src register truncation on div/mod
2026-05-15 17:58:54 +07:00
BACKPORT: bpf: Fix 32 bit src register truncation on div/mod
2026-05-15 17:58:54 +07:00
UPSTREAM: bpf: Move btf_resolve_size into __btf_resolve_size
2026-05-15 17:59:29 +07:00
UPSTREAM: bpf: tcp: Support tcp_congestion_ops in bpf
2026-05-15 17:59:24 +07:00
BACKPORT: bpf: Allow specifying a BTF ID per argument in function protos
2026-05-15 17:59:31 +07:00
BACKPORT: bpf: Support replacing cgroup-bpf program in MULTI mode
2026-05-15 17:59:23 +07:00
UPSTREAM: bpf: Remove unnecessary assertion on fp_old
2026-05-15 17:59:21 +07:00
UPSTREAM: xdp: Make cpumap flush_list common for all map instances
2026-05-15 17:59:22 +07:00
UPSTREAM: xdp: Make devmap flush_list common for all map instances
2026-05-15 17:59:22 +07:00
BACKPORT: treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2026-05-15 17:57:45 +07:00
BACKPORT: treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2026-05-15 17:57:45 +07:00
UPSTREAM: bpf: Introduce BPF dispatcher
2026-05-15 17:59:20 +07:00
UPSTREAM: Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
2026-05-15 17:58:16 +07:00
UPSTREAM: bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
2026-05-15 17:58:16 +07:00
BACKPORT: bpf: Convert bpf_prog refcnt to atomic64_t
2026-05-15 17:59:15 +07:00
UPSTREAM: bpf: Fix cgroup local storage prog tracking
2026-05-15 17:59:21 +07:00
UPSTREAM: bpf: Fix exact match conditions in trie_get_next_key()
2026-05-15 17:58:17 +07:00
BACKPORT: bpf: Implement BPF ring buffer and verifier support for it
2026-05-15 17:59:25 +07:00
UPSTREAM: bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS
2026-05-15 17:59:24 +07:00
BACKPORT: bpf: Fix 32 bit src register truncation on div/mod
2026-05-15 17:58:54 +07:00
BACKPORT: bpf: offload: add priv field for drivers
2026-05-15 17:57:32 +07:00
BACKPORT: bpf: Fix 32 bit src register truncation on div/mod
2026-05-15 17:58:54 +07:00
BACKPORT: bpf: Fix 32 bit src register truncation on div/mod
2026-05-15 17:58:54 +07:00
UPSTREAM: bpf: Avoid deadlock when using queue and stack maps from NMI
2026-05-15 17:58:15 +07:00
UPSTREAM: bpf: move memory size checks to bpf_map_charge_init()
2026-05-15 17:57:45 +07:00
UPSTREAM: bpf: Fix overrunning reservations in ringbuf
2026-05-15 17:59:34 +07:00
UPSTREAM: irq_work: Convert flags to atomic_t
2026-05-15 17:59:10 +07:00
BACKPORT: bpf: Add BPF_CGROUP_INET_SOCK_RELEASE hook
2026-05-15 17:59:25 +07:00
UPSTREAM: bpf: Fix sysfs export of empty BTF section
2026-05-15 17:58:12 +07:00
BACKPORT: bpf: Fix 32 bit src register truncation on div/mod
2026-05-15 17:58:54 +07:00
UPSTREAM: bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS
2026-05-15 17:59:24 +07:00
UPSTREAM: bpf: Fix ringbuf helper function compatibility
2026-05-15 17:59:34 +07:00
UPSTREAM: xsk: Make xskmap flush_list common for all map instances
2026-05-15 17:59:22 +07:00
30f27ca7ab