The bpf_redirect_info is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that if skb bpf_redirect_neigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpf_redirect_info struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger. With the stack-allocated bpf_redirect_info, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make sure the overlap is not re-introduced by mistake.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -6047,11 +6047,6 @@ enum { · 6046 unmodified lines | ||
| 6047 | 6047 | BPF_F_MARK_ENFORCE = (1ULL << 6), |
| 6048 | 6048 | }; |
| 6049 | 6049 | |
| 6050 | −/* BPF_FUNC_clone_redirect and BPF_FUNC_redirect flags. */ | |
| 6051 | −enum { | |
| 6052 | − BPF_F_INGRESS = (1ULL << 0), | |
| 6053 | −}; | |
| 6054 | − | |
| 6055 | 6050 | /* BPF_FUNC_skb_set_tunnel_key and BPF_FUNC_skb_get_tunnel_key flags. */ |
| 6056 | 6051 | enum { |
| 6057 | 6052 | BPF_F_TUNINFO_IPV6 = (1ULL << 0), |
| @@ -6198,10 +6193,12 @@ enum { · 140 unmodified lines | ||
| 6198 | 6193 | BPF_F_BPRM_SECUREEXEC = (1ULL << 0), |
| 6199 | 6194 | }; |
| 6200 | 6195 | |
| 6201 | −/* Flags for bpf_redirect_map helper */ | |
| 6196 | +/* Flags for bpf_redirect and bpf_redirect_map helpers */ | |
| 6202 | 6197 | enum { |
| 6203 | − BPF_F_BROADCAST = (1ULL << 3), | |
| 6204 | − BPF_F_EXCLUDE_INGRESS = (1ULL << 4), | |
| 6198 | + BPF_F_INGRESS = (1ULL << 0), /* used for skb path */ | |
| 6199 | + BPF_F_BROADCAST = (1ULL << 3), /* used for XDP path */ | |
| 6200 | + BPF_F_EXCLUDE_INGRESS = (1ULL << 4), /* used for XDP path */ | |
| 6201 | +#define BPF_F_REDIRECT_FLAGS (BPF_F_INGRESS | BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS) | |
| 6205 | 6202 | }; |
| 6206 | 6203 | |
| 6207 | 6204 | #define __bpf_md_ptr(type, name) \ |