Re: [PATCH bpf] bpf: mask speculative out-of-bounds skb helper loads

[Daniel Trujillo <datrujillo@nvidia.com>]

> Should convert_bpf_ld_abs() get the same treatment, or should the
> changelog explain why constant-offset loads are out of scope?

Thanks for pointing this out. This patch only hardens the helper fast
paths used by the leakage demonstrated with added CLFLUSH instrumentation.

The offsets for inline ABS/MSH loads are fixed by the installed filter,
so changing an offset requires replacing the filter. In the proposed
long-packet/short-packet scenario, the offset must also fit within the
training packet's linear data. Neither should prevent exploitation;
they should just make it less convenient. But I have not demonstrated
leakage through the inline ABS/MSH path experimentally, so I scoped this
patch to the demonstrated helper path.

Before deciding how/whether to harden the inline ABS/MSH path, I'd
appreciate the maintainers' views on it and on the patch as submitted.