From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f173.google.com (mail-dy1-f173.google.com [74.125.82.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8CCA33438BF for ; Mon, 1 Jun 2026 21:36:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780349793; cv=none; b=MAKbrJU19tDWbrj4QdqvWIWxfpNgs4MRglRR0zEfI2x45qL/sO7MO+cD0bzojAmY/2sJvCDsLf0Vmb0O7wSBMBkxYGQDuA2PSdQolLs2NubDcjGnERb2EErbBVAZLc86Tw4nKgDQggSycsTlBaq0UCWXt3XaIxTe5TCgiPT/vco= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780349793; c=relaxed/simple; bh=ohGvsnt5wGGrS8nCkxbknV7cYtW8Z1frw09epT2l/qE=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=Co8QHokp3uuo7A3PvwLUdcxON2byQjBt2RrQi37Uh/3yBPvxBIL4bL0bQIxYu0gwWmLLZL/KP9lSDXpGKjUGVfkRQ8NPQuKmmVj6gDIBxSQPbeWiN8fAJvXdauAbxMHUxG7T+K0m4wbmVe6CHl7btWd2jS411nQGtkCTxFfT6Kw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oUw6c95p; arc=none smtp.client-ip=74.125.82.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oUw6c95p" Received: by mail-dy1-f173.google.com with SMTP id 5a478bee46e88-304cf518c9dso6916700eec.1 for ; Mon, 01 Jun 2026 14:36:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780349792; x=1780954592; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=cbl2ijxMWZNunjPG65UITZHrQVdSUsTPik/smPG+J7A=; b=oUw6c95p7Y4weuSbUMo43WXRCB4C4Y7mBfpqhuqZUXNKM7Hy0WUizh24zsI5skLp5U RnZF8YRuoCcWyjRDdlxdL8LJwQEIqGixsiGyqCFItYPjeEHUvOVKepIuXvxqcp0WixGz 6tQwEL6m+6WMCcdRvLr4CyzodZ3+FegMBNYnU4zs02Q9R9EZzGqnzXLAqyqszruMRa5P cW2WOGTX+ouMEYgLBoG3Jt5bagw7/4BshvY2ut5B1Ybn+87ziaTpRaHwHlSmEARLEVUT jfAz30tNjHH3c0xgbamQaqLVceWbGSI61vBOrLijwj5kCWyzhs1NRueOFlP1ytO6kSQO 2YxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780349792; x=1780954592; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=cbl2ijxMWZNunjPG65UITZHrQVdSUsTPik/smPG+J7A=; b=JjHpEvbvkhvD3F+7VsZ1sxZiCqvxtTQRlO8J/yhg/dOe6AhtY18YCy+PEFR8Uh5BKM JnXOxrI0pB0Ej/0tH6J9t23bSAnf26AQhivo3LPXLSlfZsfQuVClbCpKeuVawMT8a1Qm 2ygRdzhMf8/jkomRlrQ5RP3M0Jc+WS7Dxahn54o/9vOBBb816xxmPmGrc+2DhRNGyyWU o7vAnMU7QK6HAQ0ISA8CeRR78kgYQ7AaNdr17KDqfVl9PhIZctsrr4MayRaaTbnayR8/ UDBKG/K1YkgDBkWbVk2vy/Vbm8sIYTEYSmAvyUqHXMDJIhfcETbGml2A3jBEjod0zLBY 6sWw== X-Forwarded-Encrypted: i=1; AFNElJ/0zxz0QbIg2REbvR2e7/BU+IJuNgdrBV8YmOUYJWnueWRYGmLEvlxBNKV5jbRXy1joHHDq+fXpfF/wioE=@vger.kernel.org X-Gm-Message-State: AOJu0YzIYhgdvrLU2G4VsTmA7o6qKHs9retLk3UiYpNgdXmqZaAjyy0k uhi5A/6AugIrADNeEcdpSWeu7CQYVf6X4YDDJpagJMPKcNY2S0TQfYCl X-Gm-Gg: Acq92OF3Z4vRFOmSFVNgAXDzUdtWBY46aU3DSXU/AnNpXmALYAWVqXn57TzfiDEx158 iJxGOlJtvbCT81HX6YGjgeXEGocWtdsfy59iwg4f32fHJOKgFpBEO7oO6u/Jtps3fIrBKoCOsA1 mjBS3ZBcd6PLbNamhs1KkPOwYQn2fx9oajdaMyt7qBdljzvvtJQSlhj5193G/tbUoKXjRmQiswp 4fbHbhO0PkXIgctgQx1jfXSk+fMwZWZvGcyMjM+lGd0dHaPHpXphhiGZyCdAKBsIap9RYayGtq4 tQZyxyoFfN0I1YEDSwANb3cxTVIvBxg4MLPJWOI6v/3nEyI6BcTtkmCSGzlNN3TkcgU5ER9UaTS PK+6k+93tQMIy/Vi+L8luPpRv9l4Ug6J2F5AZooEpaxLppD8jdsXR9Dxi6aFu6NTB0Yo1//gOEP r+a+EQOlmgZ92AoD5CxNiTSh3uWqv8afTU1NdO/fJl2zODH45Yl7BSmm+1HbyI6vU12Ot+qKvTm 7o6wbO8irdMTdSUEao= X-Received: by 2002:a05:7300:3b07:b0:304:e6fb:f2f0 with SMTP id 5a478bee46e88-304fa6a904dmr6476151eec.34.1780349791549; Mon, 01 Jun 2026 14:36:31 -0700 (PDT) Received: from ?IPv6:2a03:83e0:115c:1:c3a5:3c8c:3e68:6e4d? ([2620:10d:c090:500::1:c0f8]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-304ed2c312csm10231858eec.6.2026.06.01.14.36.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2026 14:36:31 -0700 (PDT) Message-ID: <5168f215501c61b3b53e592f35569768e82f0cef.camel@gmail.com> Subject: Re: [PATCH bpf v2 1/2] bpf: Fix kfunc implicit arg inject type detection to prevent invalid pointer deref From: Eduard Zingerman To: chenyuan_fl@163.com Cc: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org, chenyuan@kylinos.cn, daniel@iogearbox.net, jolsa@kernel.org, linux-kernel@vger.kernel.org, martin.lau@linux.dev, memxor@gmail.com, song@kernel.org, yonghong.song@linux.dev Date: Mon, 01 Jun 2026 14:36:29 -0700 In-Reply-To: <20260601064611.807637-2-chenyuan_fl@163.com> References: <20260407080900.551797-1-chenyuan_fl@163.com> <20260601064611.807637-1-chenyuan_fl@163.com> <20260601064611.807637-2-chenyuan_fl@163.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.60.1 (3.60.1-1.fc44) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Mon, 2026-06-01 at 14:46 +0800, chenyuan_fl@163.com wrote: [...] > @@ -11899,8 +11932,17 @@ static int check_kfunc_args(struct bpf_verifier_= env *env, struct bpf_kfunc_call_ > u32 ref_id, type_size; > bool is_ret_buf_sz =3D false; > int kf_arg_type; > - > - if (is_kfunc_arg_prog_aux(btf, &args[i])) { Thank you for figuring out this corner case. I don't think I like matching the type by name here, though. Wdyt about a somewhat more generic solution described below? bpf_fixup_kfunc_call() lists all the cases when verifier injects an implicit argument: - functions with KF_IMPLICIT_ARGS flag and a parameter of type bpf_prog_aux= . - functions with KF_IMPLICIT_ARGS allowed by is_bpf_list_push_kfunc() / is_bpf_rbtree_add_kfunc(). =20 Meaning that current check_kfunc_arg() code can be changed as follows: if (is_kfunc_arg_prog_aux(btf, &args[i])) { ... unmodified ... continue; } if (is_bpf_list_push_kfunc(...) || is_bpf_rbtree_add_kfunc(...)) { ... continue; } if (is_kfunc_arg_implicit(meta, i)) { ... report error ... return -EFAULT; } Thus catching all the cases. > + enum kfunc_inject_arg_type inject_type; > + > + inject_type =3D get_kfunc_arg_inject_type(btf, &args[i]); > + switch (inject_type) { > + case KF_INJECT_ARG_PROG_AUX: > + /* Validate the arg type against vmlinux's definition */ > + if (!is_kfunc_arg_prog_aux(btf, &args[i])) { > + verbose(env, "arg#%d implicit argument type mismatch, " > + "expected struct bpf_prog_aux *\n", i); > + return -EINVAL; > + } > /* Reject repeated use bpf_prog_aux */ > if (meta->arg_prog) { > verifier_bug(env, "Only 1 prog->aux argument supported per-kfunc"); [...]