hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20452 CVE: CVE-2026-98799 -------------------------------- The upstream fix for CVE-2026-98799 removed ip_after_call and ip_epilogue from bpf_tramp_image and inserted new fields into the middle and tail of bpf_tramp_image/bpf_trampoline, breaking their layouts and the CRCs of all symbols type-reachable from them. Fix it with KABI_REPLACE and use KABI_RESERVE, so that the genksyms CRCs and all pre-existing member offsets stay unchanged. Fixes: 17637e1a581a ("bpf: Skip detached progs in trampoline images that are still in use") Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- include/linux/bpf.h | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index ff1e050bc9a2..761fb23b330f 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1256,21 +1256,24 @@ struct bpf_tramp_image { void *image; struct bpf_ksym ksym; struct percpu_ref pcref; - bool call_orig; + KABI_REPLACE2(void *ip_after_call, + int nr_skips, + bool call_orig) /* entry in tr->images, the image holds a reference on tr */ - struct bpf_trampoline *tr; - struct list_head list; - int nr_skips; - struct bpf_tramp_skip *skips; + KABI_REPLACE(void *ip_epilogue, struct bpf_trampoline *tr) union { struct rcu_head rcu; struct work_struct work; }; KABI_USE(1, int size) +#ifndef __GENKSYMS__ + struct list_head list; +#else KABI_RESERVE(2) KABI_RESERVE(3) - KABI_RESERVE(4) +#endif + KABI_USE(4, struct bpf_tramp_skip *skips) }; static inline void bpf_tramp_image_add_skip(struct bpf_tramp_image *im, struct bpf_prog *prog, @@ -1312,12 +1315,15 @@ struct bpf_trampoline { int progs_cnt[BPF_TRAMP_MAX]; /* Executable image of trampoline */ struct bpf_tramp_image *cur_image; - /* Images not freed yet, cur_image and older ones still in use */ - struct list_head images; struct module *mod; +#ifndef __GENKSYMS__ + /* Images not freed yet, cur_image and older ones still in use */ + struct list_head images; +#else KABI_RESERVE(1) KABI_RESERVE(2) +#endif KABI_RESERVE(3) KABI_RESERVE(4) }; -- 2.34.1