From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=95.215.58.122 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794006730; b=YFrcGW68lXPKnnvy7U1VktD8DhpukBqIB/vw16C6cb1qcGTWtRKYtlEB+C1IT6Vy3GTq G9AeSInqc7VlzUv+VpR8MrebU5m4syc2vHP4BhzzdrSi0CC/PMdX2MdXAxVDqH4QvROOW zFW4tlf5h2zwRxVYtixa3/39Er2ptXJGCrJTxN0j1ZQTKOpsZ/EkSGqzvg4n/hoPzO1uO +AyEYTM0YhqgUGh7dm4VJy3v0H7yG6/7RcKRfDw0GMrtd9mpDhTmk5vrzOy/dkFOeHkZJ WKHHx18RcgOK8/j3tYNyy5TcMHP/uPEq6CrNe0E6341dJ0g8pIx4NVREW0pivpcgJ6Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794006730; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:From:To:Cc:Subject:Date:Message-ID: X-Mailer:MIME-Version:Content-Transfer-Encoding; bh=UbpFueGBEvU53Vb7/q/PLhrOg44UG6dCmPzDN0HPnNM=; b=qi2FAi/TV3osFmZf2sBXL1XOipd/INnyOY+MZvjsPMPRMil0sr8Y26RoKCaVZ9lY2wze 9yrgPy4off6Gpg8CCoFKv0yrhT+qKtlnWFw2SZXs6W1LuKxWl1gGrQG2MDS1dypBtvUV2 hKSuPJZz47Okdu+8XvM+Vftq5UUUkZMzV8LnCuMgteQVho1s/AirvkQFAAb6TxE7bWqoK X6V21X9zFvxm/OJf0muGC2InWIXDym4ylXi19vQpg1mao4caWQA2PafSjDPr78iJ4BxOp pR1By+DHactiUxstYKWYQ80fcbDMrHBh7QVd3ROTQLQB0hSAVvvKlT1TFlS/ScqQGNg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=CDuhJUnK; arc=none smtp.remote-ip=95.215.58.122 Received: from mta1.migadu.com (out-122.mta1.migadu.com [95.215.58.122]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FA83606A326 for ; Fri, 6 Nov 2026 23:12:09 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 7FA83606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=CDuhJUnK X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=LNw6d4GW0mbl2KSWZ2jOylagT+FVNJ4ieKN77f/dhjY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1794006727; v=1; x=1794611527; b=CDuhJUnKzabU0b8UvRoJ2bk8PxK6ucEH6vA8nMw3Up+EgoywyZa+umT7uPAjrL2UK/4MCuye YTuG3LKinbahycxAmhqj7wwxhT0RPrurdBIrLg9/hb/6wCGiN4tCaHTPdZ5qzpnD56BtFt7wDBj TZLRYIp4ue4rufUIdiLs7Lgk= X-Envelope-To: linux-kernel@vger.kernel.org Received: by mta11.migadu.com with ESMTPS id b8ac95d11857e0d1; Fri, 06 Nov 2026 23:12:07 +0000 X-Mizu-Trace-ID: b8ac95d11857e0d1 X-Migadu-Flow: FLOW_OUT From: Ihor Solodrai To: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Eduard Zingerman , Kumar Kartikeya Dwivedi Cc: Amery Hung , Emil Tsalapatis , Nicholas Carlini , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com Subject: [PATCH bpf v1 0/4] bpf: Scope callback arguments to their frame Date: Fri, 6 Nov 2026 16:11:53 -0700 Message-ID: <20261106231157.2840635-1-ihor.solodrai@linux.dev> X-Mailer: git-send-email 2.56.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A callback-calling helper can pass its callback a pointer that is only valid for the callback invocation, and the verifier has no way to express that lifetime. Two helpers need fixing: * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a sample it releases as soon as the callback returns. Saving this pointer in callback_ctx leaves it pointing into reused kernel stack and allows arbitrary kernel read and write since v7.3. * bpf_for_each_map_elem() over an array or per-CPU array map passes the address of a u32 held in bpf_for_each_array_elem()'s own frame, leaking four bytes of kernel stack. Give the callback frame an id and make it both the id and the parent_id of such an argument, so that slices and clones descend from it. Invalidate the id and its descendants when the frame is popped. --- v2->v3: * Replace REF_TYPE_FRAME with a frame_id in bpf_func_state and drop the preparation and refactoring patches (Alexei) * Rebase on bpf, and add Fixes: tags v2: https://lore.kernel.org/r/20261009202759.50520-1-ihor.solodrai@linux.dev v1->v2: * Add the refactoring patches: release frame references in one scan, and fold diagnostics into the REF_TYPE_FRAME introduction * Replace temporary argument mask and deferred register scan with reference acquisition directly in the owning verifier state during callback setup (Eduard) * Reuse callback_park_dynptr() for the nested drain test v1: https://lore.kernel.org/r/20260922010333.1226537-1-ihor.solodrai@linux.dev --- Ihor Solodrai (4): bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame selftests/bpf: Cover the user ringbuf callback dynptr lifetime bpf: Scope the bpf_for_each_map_elem() array key to the callback frame selftests/bpf: Cover callback-frame map key lifetime include/linux/bpf.h | 2 + include/linux/bpf_verifier.h | 2 + kernel/bpf/arraymap.c | 19 ++- kernel/bpf/states.c | 3 + kernel/bpf/verifier.c | 16 +++ .../selftests/bpf/progs/user_ringbuf_fail.c | 135 ++++++++++++++++++ .../bpf/progs/verifier_iterating_callbacks.c | 91 ++++++++++++ 7 files changed, 266 insertions(+), 2 deletions(-) base-commit: 475a0cfd02f14d764023e926ac01fc7597134229 -- 2.56.0