]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
authorDaniel Borkmann <daniel@iogearbox.net>
Thu, 16 Apr 2026 12:27:19 +0000 (14:27 +0200)
committerAlexei Starovoitov <ast@kernel.org>
Thu, 16 Apr 2026 14:35:22 +0000 (07:35 -0700)
commite5f635edd393aeaa7cad9e42831d397e6e2e1eed
tree14bbc781a366d1213e5b1ace1b4e609863e0c7f5
parent1cedfe17badeebdcc044855713597ac7db58414a
bpf: Fix precedence bug in convert_bpf_ld_abs alignment check

Fix an operator precedence issue in convert_bpf_ld_abs() where the
expression offset + ip_align % size evaluates as offset + (ip_align % size)
due to % having higher precedence than +. That latter evaluation does
not make any sense. The intended check is (offset + ip_align) % size == 0
to verify that the packet load offset is properly aligned for direct
access.

With NET_IP_ALIGN == 2, the bug causes the inline fast-path for direct
packet loads to almost never be taken on !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
platforms. This forces nearly all cBPF BPF_LD_ABS packet loads through
the bpf_skb_load_helper slow path on the affected archs.

Fixes: e0cea7ce988c ("bpf: implement ld_abs/ld_ind in native bpf")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260416122719.661033-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
net/core/filter.c