In the Linux kernel, the following vulnerability has been resolved: bpf: check changespktdata property for extension programs When processing calls to global sub-programs, verifier decides whether to invalidate all packet pointers in current state depending on the changespktdata property of the global sub-program. Because of this, an extension program replacing a global sub-program must be compatible with changespktdata property of the sub-program being replaced. This commit: - adds changespktdata flag to struct bpfprogaux: - this flag is set in checkcfg() for main sub-program; - in jitsubprogs() for other sub-programs; - modifies bpfcheckattachbtfid() to check changespktdata flag; - moves call to checkattachbtfid() after the call to checkcfg(), because it needs changespktdata flag to be set: bpfcheck: ... ... - checkattachbtfid resolvepseudoldimm64 resolvepseudoldimm64 --> bpfprogisoffloaded bpfprogisoffloaded checkcfg checkcfg + checkattachbtfid ... ... The following fields are set by checkattachbtfid(): - env->ops - prog->aux->attachbtftrace - prog->aux->attachfuncname - prog->aux->attachfuncproto - prog->aux->dsttrampoline - prog->aux->mod - prog->aux->saveddstattachtype - prog->aux->saveddstprogtype - prog->expectedattachtype Neither of these fields are used by resolvepseudoldimm64() or bpfprogoffloadverifier_prep() (for netronome and netdevsim drivers), so the reordering is safe.