Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19749 CVE: CVE-2026-98044 -------------------------------- There has 1 hole in struct bpf_subprog_info, it can use KABI_FILL_HOLE to fix this kabi breakage. $ pahole -C bpf_subprog_info vmlinux struct bpf_subprog_info { u32 start; /* 0 4 */ u32 linfo_idx; /* 4 4 */ u16 stack_depth; /* 8 2 */ bool has_tail_call; /* 10 1 */ bool tail_call_reachable; /* 11 1 */ bool has_ld_abs; /* 12 1 */ bool is_async_cb; /* 13 1 */ bool changes_pkt_data; /* 14 1 */ /* XXX 1 byte hole, try to pack */ u64 kabi_reserved1; /* 16 8 */ u64 kabi_reserved2; /* 24 8 */ u64 kabi_reserved3; /* 32 8 */ u64 kabi_reserved4; /* 40 8 */ /* size: 48, cachelines: 1, members: 12 */ /* sum members: 47, holes: 1, sum holes: 1 */ /* last cacheline: 48 bytes */ }; Fixes: e7d28823c662 ("bpf: Reject legacy packet loads from callbacks") Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- include/linux/bpf_verifier.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index d11be54579b8..75957f614b85 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -641,7 +641,7 @@ struct bpf_subprog_info { bool tail_call_reachable; bool has_ld_abs; bool is_async_cb; - bool is_cb; + KABI_FILL_HOLE(bool is_cb) KABI_FILL_HOLE(bool changes_pkt_data) KABI_RESERVE(1) -- 2.34.1