Bradley MorganandGreg Kroah-Hartman aa265d4730 bpf: Disable xfrm_decode_session hook attachment ...

[ Upstream commit 12091470c6 ]

BPF LSM programs can currently attach to xfrm_decode_session(). That
hook may return an error, but security_skb_classify_flow() calls it
from a void path and triggers BUG_ON() if an error is returned.

Disable BPF attachment to the hook to prevent a BPF LSM program from
turning packet classification into a full panic.

Fixes: 9e4e01dfd3 ("bpf: lsm: Implement attach, detach and execution")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Link: https://lore.kernel.org/r/20260619130305.27779-1-include@grrlz.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-07-24 15:54:52 +02:00

..

preload

…

arraymap.c

…

bloom_filter.c

…

bpf_inode_storage.c

…

bpf_iter.c

…

bpf_local_storage.c

…

bpf_lru_list.c

…

bpf_lru_list.h

…

bpf_lsm.c

bpf: Disable xfrm_decode_session hook attachment

2026-07-24 15:54:52 +02:00

bpf_struct_ops_types.h

…

bpf_struct_ops.c

…

bpf_task_storage.c

…

btf.c

bpf: Release module BTF IDR before module unload

2026-04-11 14:16:02 +02:00

cgroup_iter.c

…

cgroup.c

bpf: Restore sysctl new-value from 1 to 0

2026-07-24 15:54:25 +02:00

core.c

bpf: Tighten cgroup storage cookie checks for prog arrays

2026-07-24 15:54:41 +02:00

cpumap.c

…

devmap.c

bpf: Run generic devmap egress prog on private skb

2026-07-24 15:54:43 +02:00

disasm.c

…

disasm.h

…

dispatcher.c

…

hashtab.c

…

helpers.c

bpf: allow UTF-8 literals in bpf_bprintf_prepare()

2026-06-01 17:39:18 +02:00

inode.c

bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

2026-07-24 15:54:38 +02:00

Kconfig

…

link_iter.c

…

local_storage.c

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

2026-06-01 17:39:06 +02:00

log.c

…

lpm_trie.c

…

Makefile

…

map_in_map.c

…

map_in_map.h

…

map_iter.c

…

memalloc.c

…

mmap_unlock_work.h

…

net_namespace.c

…

offload.c

…

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

reuseport_array.c

…

ringbuf.c

bpf: Sync pending IRQ work before freeing ring buffer

2025-12-07 06:12:11 +09:00

stackmap.c

…

syscall.c

bpf: Check tail zero of bpf_prog_info

2026-07-24 15:54:39 +02:00

sysfs_btf.c

…

task_iter.c

…

tnum.c

…

trampoline.c

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

2026-03-25 11:03:01 +01:00

verifier.c

bpf: Fix stack slot index in nospec checks

2026-07-24 15:54:51 +02:00