From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f45.google.com (mail-ot1-f45.google.com [209.85.210.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A071409602 for ; Mon, 15 Jun 2026 15:51:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781538708; cv=none; b=Tx33Eh5639PHlA1z3hylQYFjVkZp8k9ZIx73ucsP3SQMe2wvW7KEMYxdDgCZm8c23AxXL0qL3ZhD+De46lj0mE64HpfN4tLLPk0gv5FsdYlkg23z3/4JrWC3jQej0s47YunN+J+cDqKJKMbCWqJItyeLnjxq1uTC8rbb4qac6ss= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781538708; c=relaxed/simple; bh=q9e2NvWanWWTeyoVVHWGTmNx+4ZjhqA8PPerijFqXzg=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To: References:In-Reply-To; b=r/+1STD2MouvsdBkjQbBGGA1v5/2VMdjXmbPel8YZRpMiQOfB6O2qbt453cDuzNpMnDnOds1Mb57fr1SrtvpXH9RHqakug5iUGXzicHqN/aWaCXooNNbLFoJsHxdVsnbIZbt5hkkfh8NMOLdoL1WcGXOi1tKicwew1wWvo4mNko= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Vr6+iDBs; arc=none smtp.client-ip=209.85.210.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Vr6+iDBs" Received: by mail-ot1-f45.google.com with SMTP id 46e09a7af769-7e6da33a561so3215481a34.3 for ; Mon, 15 Jun 2026 08:51:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781538706; x=1782143506; darn=vger.kernel.org; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=mIdch/GXuFS4bjK3LcJavigFgN1lb+ICZqzVniuexrA=; b=Vr6+iDBsV/BENVkRqlUxRB6liSH/JeKZqGyNysfp9T5yACZivQNfrpuGPWVAJGUY7s q7ToV2vYcIOHqB3MtYGFSde3Q71d0P1T1lHDepx0S4q53r9Y9x21xaF3B1JgQOGi5LVz xU/BqAiVwGddWqrP7yWpiGywcAKObgOMLFJHIrFyEDBAtUCkq+BFnmHHNG+7vPPv7+l2 LW5RoyTwuqQTQkezxkCFerFx01P9fzQsKf3MI63gHtmU+6Vs4pQ383tmw2o9/JMye+L4 lLaC1P3NqP1o8mh0BbPwUaWtmD7EjX4mPRvBUuToWpi6TptaiGnvf2GLkNgBVL3EgFq4 vmRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781538706; x=1782143506; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=mIdch/GXuFS4bjK3LcJavigFgN1lb+ICZqzVniuexrA=; b=oU5lTNPZ4GDDZZ3ZZ7jRG1gIOI9lLtAgbjR+PiOFznrl4jMsp7jgMxnpiNYQufPMcV IV9kYgqnHUJojotLUjTb1gqG0P+C8Wo4wYJzimE1XiqUmH/6dyF+XVz2HONB4u2nVEcZ acy2UVKEIDQbThELaEb2u4tB68IV2FsF+TogqSlLDyRmSL3ReYVoDo45zRv0TMIhcZqV OFFyK3xpvr1QWc4j990LGtTGvnG8xyAGgAn0MW6EGWLsfoIT3Ro0UeOdglpPB/LCNbhl VvXjJ87Mv04Hsz9C0+uLOCx540CyVGRTDPhnAhLyYZxy7xlARu3dw7R9Qx/Gzg/WBPlr ztqQ== X-Forwarded-Encrypted: i=1; AFNElJ9IvsVomqM1Ik/tTB1/rYt6WxmRvtp8dCN158wHf5IBNMDPplfw/ShAQavcWiN4Xi38ydZyDPimv5Z2m9I=@vger.kernel.org X-Gm-Message-State: AOJu0Yym76BHhLK18Aho8zatJv/7UbP7RE9xenYvkKEWW3GWeG3hzJo4 /w3YrdB/AELiIp4GUQ1IVmRQcGvAW0UzOlVspjGdseEPopWnEnFWiVeJ X-Gm-Gg: Acq92OHu3llA4qcAvbteOkanfta4UtNNCKNLENohCS1ZK64mTjr1DA2aCx0ZUUG5Gj8 a6S/8ZgwxfnirJs30CaA4IqFubw7kobxOAupkhGOl4vpfvOd5ddB4Q3VhKkgPlVnYH5FukNjKfq jl8obOs63hMeaLhYd5PNUWqivesdruMQCzVouTPLDzBfr1xVDaeDk7DbmTxFZRCMpmeWtbrobzn C3TChZHeufXqvy9yZcFvPHupr1taNT7tRpV6MrLr2SfB0S+uS5RNwoXMwAd8YJOvSPJwb8KvpXo nSDitfqlGCcFBMdJ2jHYUD+6KYHJtwrbWpGb9favRIGwEut58VPTM5WZJLPHgoae5bCdiTh4ro/ I6PIolUg9taE3/+aZOY4KXvFHkGjxd+YJzGy0n3m/zbuOf41FweiiU3LAoMvrOt3K2xJEexeAAF 2tR8rq30CH0PjdkWwJ/g2kHmlvhChjuQTbpso1oJ3nu8Jja4RzoJz0a5CKHK+f23cpTRNmyPokC pUyk1G91cv516L8nT3qJssbDnoT X-Received: by 2002:a05:6830:380d:b0:7e6:f4a3:1dfc with SMTP id 46e09a7af769-7e784895f7emr9886125a34.23.1781538706341; Mon, 15 Jun 2026 08:51:46 -0700 (PDT) Received: from localhost ([2a03:2880:10ff:5a::]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7e79f6dfaf4sm4498667a34.21.2026.06.15.08.51.45 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 Jun 2026 08:51:45 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Mon, 15 Jun 2026 08:51:44 -0700 Message-Id: Cc: "Alexei Starovoitov" , "Daniel Borkmann" , "Andrii Nakryiko" , "Eduard Zingerman" , "Kumar Kartikeya Dwivedi" , "Martin KaFai Lau" , "Song Liu" , "Yonghong Song" , "Jiri Olsa" , "Emil Tsalapatis" , "John Fastabend" , "Shuah Khan" , , Subject: Re: [PATCH bpf 1/2] bpf: Fix packet pointer invalidation for skb dynptr writes From: "Alexei Starovoitov" To: "Yiyang Chen" , X-Mailer: aerc References: <20260615120752.155006-1-chenyy23@mails.tsinghua.edu.cn> In-Reply-To: <20260615120752.155006-1-chenyy23@mails.tsinghua.edu.cn> On Mon Jun 15, 2026 at 5:07 AM PDT, Yiyang Chen wrote: > skb-backed dynptr writer kfuncs can mutate skb packet storage. > The verifier currently treats kfunc calls as packet-changing only for > bpf_xdp_pull_data(). > > That leaves direct packet pointers usable after skb dynptr writer kfuncs. > The helper path already clears packet pointers for bpf_dynptr_write(). > > Mark kfunc calls packet-changing when argument 0 is a writable skb or > skb-meta dynptr destination. This covers bpf_dynptr_copy(), > bpf_dynptr_memset(), and probe/copy-from-user dynptr writers. > Source-only dynptr arguments are left unchanged. > > Fixes: daec295a70941 ("bpf/helpers: Introduce bpf_dynptr_copy kfunc") > Fixes: a498ee7576de ("bpf: Implement dynptr copy kfuncs") > Fixes: 5fc5d8fded57 ("bpf: Add bpf_dynptr_memset() kfunc") > Signed-off-by: Yiyang Chen > --- > include/linux/bpf_verifier.h | 1 + > kernel/bpf/verifier.c | 62 +++++++++++++++++++++++++++++++++++- > 2 files changed, 62 insertions(+), 1 deletion(-) > > diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h > index 39a851e690ec4..c7d0c20a4961b 100644 > --- a/include/linux/bpf_verifier.h > +++ b/include/linux/bpf_verifier.h > @@ -1448,6 +1448,7 @@ struct bpf_kfunc_call_arg_meta { > /* Out parameters */ > u8 release_regno; > bool r0_rdonly; > + bool pkt_dynptr_write; > u32 ret_btf_id; > u64 r0_size; > u32 subprogno; > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index 2abc79dbf281c..5ea51bd284f84 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -11016,6 +11016,16 @@ enum special_kfunc_type { > KF_bpf_xdp_pull_data, > KF_bpf_dynptr_slice, > KF_bpf_dynptr_slice_rdwr, > + KF_bpf_dynptr_copy, > + KF_bpf_dynptr_memset, > + KF_bpf_probe_read_user_dynptr, > + KF_bpf_probe_read_kernel_dynptr, > + KF_bpf_probe_read_user_str_dynptr, > + KF_bpf_probe_read_kernel_str_dynptr, > + KF_bpf_copy_from_user_dynptr, > + KF_bpf_copy_from_user_str_dynptr, > + KF_bpf_copy_from_user_task_dynptr, > + KF_bpf_copy_from_user_task_str_dynptr, > KF_bpf_dynptr_clone, > KF_bpf_percpu_obj_new_impl, > KF_bpf_percpu_obj_new, > @@ -11096,6 +11106,27 @@ BTF_ID_UNUSED > #endif > BTF_ID(func, bpf_dynptr_slice) > BTF_ID(func, bpf_dynptr_slice_rdwr) > +BTF_ID(func, bpf_dynptr_copy) > +BTF_ID(func, bpf_dynptr_memset) > +#ifdef CONFIG_BPF_EVENTS > +BTF_ID(func, bpf_probe_read_user_dynptr) > +BTF_ID(func, bpf_probe_read_kernel_dynptr) > +BTF_ID(func, bpf_probe_read_user_str_dynptr) > +BTF_ID(func, bpf_probe_read_kernel_str_dynptr) > +BTF_ID(func, bpf_copy_from_user_dynptr) > +BTF_ID(func, bpf_copy_from_user_str_dynptr) > +BTF_ID(func, bpf_copy_from_user_task_dynptr) > +BTF_ID(func, bpf_copy_from_user_task_str_dynptr) > +#else > +BTF_ID_UNUSED > +BTF_ID_UNUSED > +BTF_ID_UNUSED > +BTF_ID_UNUSED > +BTF_ID_UNUSED > +BTF_ID_UNUSED > +BTF_ID_UNUSED > +BTF_ID_UNUSED > +#endif > BTF_ID(func, bpf_dynptr_clone) > BTF_ID(func, bpf_percpu_obj_new_impl) > BTF_ID(func, bpf_percpu_obj_new) > @@ -11229,7 +11260,33 @@ static bool is_kfunc_bpf_preempt_enable(struct b= pf_kfunc_call_arg_meta *meta) > =20 > bool bpf_is_kfunc_pkt_changing(struct bpf_kfunc_call_arg_meta *meta) > { > - return meta->func_id =3D=3D special_kfunc_list[KF_bpf_xdp_pull_data]; > + return meta->func_id =3D=3D special_kfunc_list[KF_bpf_xdp_pull_data] || > + meta->pkt_dynptr_write; > +} Nack. You misunderstand what bpf_is_kfunc_pkt_changing() is doing. pw-bot: cr