From: Feng Yang <yangfeng59949@163.com>
To: memxor@gmail.com
Cc: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, eddyz87@gmail.com, emil@etsalapatis.com,
ihor.solodrai@linux.dev, jolsa@kernel.org, kpsingh@kernel.org,
linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org,
martin.lau@linux.dev, mathieu.desnoyers@efficios.com,
matt@bobrowski.net, mhiramat@kernel.org, rostedt@goodmis.org,
song@kernel.org, yangfeng59949@163.com, yonghong.song@linux.dev
Subject: Re: [PATCH v2 bpf-next 1/2] bpf: Reject bpf_skb_output() from return-side tracing
Date: Tue, 22 Sep 2026 15:03:48 +0800 [thread overview]
Message-ID: <20260922070348.485673-1-yangfeng59949@163.com> (raw)
In-Reply-To: <DLLHE9PBLDU0.XQGEOQQIR4HV@gmail.com>
On Tue, 22 Sep 2026 04:15:13 +0200, Kumar Kartikeya Dwivedi wrote:
> On Tue Sep 22, 2026 at 3:54 AM CEST, Feng Yang wrote:
> > From: Feng Yang <yangfeng@kylinos.cn>
> >
> > BPF fexit programs run after the traced function returns, while their
> > context still contains the original function argument values. A traced
> > function is free to consume an skb argument before returning, so the
> > pointer seen by fexit can already be stale.
> >
> > The verifier checks that the first argument to bpf_skb_output() has the
> > BTF type of struct sk_buff, but that does not establish its lifetime.
> > bpf_skb_event_output() then dereferences skb->len and can trigger a
> > use-after-free.
> >
> > Do not expose bpf_skb_output() to tracing programs which can run after
> > the target: fexit, fexit.multi, fsession and fsession.multi. Keep it
> > available to fentry and other tracing attach types where it is already
> > supported. fsession must be rejected because the same program runs on
> > both entry and return and the verifier cannot prove that a helper call
> > is entry-only.
> >
> > Fixes: fec56f5890d9 ("bpf: Introduce BPF trampoline")
> > Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn>
> > Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
> > Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
> > Closes: https://lore.kernel.org/all/9d61b891-2d52-42b9-bc1a-ad963ccb675d@std.uestc.edu.cn/
> > Signed-off-by: Yun Lu <luyun@kylinos.cn>
> > Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
> > ---
>
> Sorry, this is not an acceptable fix. This negates usage of the function in all
> fexit and fession attach points. Unless there is a simpler way to enumerate in
> which attach points this helper should be disabled, it might not be worth doing
> and leaving this be as is.
>
Thanks for your reply. That is indeed correct.
Moreover, the comment for `bpf_skb_output` in `include/uapi/linux/bpf.h`
reads: "This helper is similar to bpf_perf_event_output() but restricted to
raw_tracepoint bpf programs.", yet this comment is actually outdated.
> pw-bot: cr
prev parent reply other threads:[~2026-09-22 7:04 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-22 1:54 Feng Yang
2026-09-22 1:54 ` [PATCH v2 bpf-next 2/2] selftests/bpf: Check bpf_skb_output() tracing restrictions Feng Yang
2026-09-22 2:46 ` bot+bpf-ci
2026-09-22 2:15 ` [PATCH v2 bpf-next 1/2] bpf: Reject bpf_skb_output() from return-side tracing Kumar Kartikeya Dwivedi
2026-09-22 7:03 ` Feng Yang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260922070348.485673-1-yangfeng59949@163.com \
--to=yangfeng59949@163.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=mathieu.desnoyers@efficios.com \
--cc=matt@bobrowski.net \
--cc=memxor@gmail.com \
--cc=mhiramat@kernel.org \
--cc=rostedt@goodmis.org \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®