From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f173.google.com (mail-dy1-f173.google.com [74.125.82.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B2AA537882E for ; Mon, 22 Jun 2026 22:27:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782167238; cv=none; b=bZuAEivlgbimVCCn8A20qCTSCbsB/NjGC2hes2WkQ1awlcoYlrxGs0xfHtXdIZ3lTOYcrr87BNmi/CIGYPlut4BKDAswQE5Btuzdfidfcjj8fY2TzRWG+1zXpdhozEp5ZeoWUGZTilh0ULRfJn0ezQgECJu1oetFsw1bC1812RM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782167238; c=relaxed/simple; bh=/tVkvwERQ5Ln4nwdML8M/9De92U0MHKhf3CNldLpgu8=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=dCEj5A2dbzouQ0jdXgi7e+nNmYSrSYq5hrRQIEjEbS4idCcEiOI1skozs6pi6C/+dvfeu/KjY9ScSipxji2n1gHrhr85R/6QCZLeAtHsbEL+bIcgKoB/IwZ5b/uFZ/DJfFmUTdO0ke56HpZtgMv+Rgo0WQNvuJfExyY60e/jGto= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lO+7ys/F; arc=none smtp.client-ip=74.125.82.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lO+7ys/F" Received: by mail-dy1-f173.google.com with SMTP id 5a478bee46e88-3078e0dcd67so5842907eec.0 for ; Mon, 22 Jun 2026 15:27:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782167237; x=1782772037; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=68bd0s/HDhL9fFkyParx82/swCBZhwBtVpT9ZYWzL1Y=; b=lO+7ys/Fq17/o7Tspe/IdBQ6qwqnjBG+jM/9DYFO8GtPR6woUCDxPGeOfLgt7BOfzn eZK1M3ZESF0Y5PsCl9UwziisEAd7Qc2Mq5pql9+hvYf2adQM9xXl+sjp9u88IMdiyKXH CQPsQ0YnKW+wJXrQMfVtT6sFcEZK8KgOVcihZ6Q1OmTo25YVKw8jj4n0AAAak+AEZ4YD 5s4tRPRMGuwXSwVPy7lPw8NsJ3TBAtTFTZi+3aEiiuvUSCsmNWTzg7G91vohEcnXGUS2 3Q0ThIxoB3OqbFHovQvDzbAw8jxzHFkFM1hnGYpEtmIjPpVC0i5w5EXWYUESREM57RGK Ae6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782167237; x=1782772037; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=68bd0s/HDhL9fFkyParx82/swCBZhwBtVpT9ZYWzL1Y=; b=X+yagLUWKsvb/WaBAIcqzAEFtYx2rfZZBPiBlJFDQK/j9dbtXlij3GgdkDWnWMxGQZ 4NRxsYmcwIOYs6bLY8PS2yzPocjGoNYxaJb892wy5UNhfSJ6PUvg3joH58qIgJQbN9gG z+yofygE8Up2dwfT7Zf7B3Gz1iYPG7zYModGiOtiLdQ3GetOW+8PzBa48a+VqnUgj3dT yozPPM+LrqXvKokCs0mHE82VyaXnJHnvEVaj+AXqXQBI5nQz4kFVK2CRssVmEcHvFffw sjwb0Nqli7SevJuC6zJVIb5l3lX/7mo4/+bHLdKE6gZnechiG7jsjjJgDm6yD5Lw6xxT bc6g== X-Forwarded-Encrypted: i=1; AHgh+RrDrHenu/Fmkxt392nSpdPYmCW9NchfVebea8XdPhI8piyJuyicCtfz0ymveuceSFGg4WTLL/KV/KPYPJU=@vger.kernel.org X-Gm-Message-State: AOJu0YxdhAC30S81gEAzEZaD5Rgsdo8rfHBFMjSYMdQSwJZVCFLk9Oka aaJogDNBOMm7zaRLGb1VnEDb23fo2sln4npMEGrbmMFPrewLIghF0URO X-Gm-Gg: AfdE7ckHWcj53Rd/gqGU7KQi2IjDcVxwm+16Eg83Z/yLwxkY7hGUsW/79to7jA37CN9 BO1g/z3Byb8zrTfY5t3GxlEByWmk4rZDHr0Wt7ASFD17OriQc4HcucezXm5n9D9m/UZEv6ZmMMQ nxweZ64zsPcQq1A8ZWIH0L2KNazEhBD2hA/TyKtYVe73cAyv/OVElG8D/UaiX61RDnSNxZZj9Zs HbEt91/qhEuZdhERtWPmZ2BU9OjEPwerf74NVKGuaCWaSkbordeQTEA2KcrY7vnnrYgu9bFr77+ 8ETK77MvlA3WbWClEOX8lJj/8V6VK7qT4nCJVJ5ClUqdbH+orFY8zPD8T7r0A0z1SUfhFbRb/+R Q9J4vtQFpcRlKsRNC7Wso9kQe7Y4jpihAoJlNNb7UBCYNlOdn6KQA9LMlD6NKVBLTlsZjYZW4f+ i0sML1QIB9uHAj0jiM1dOktCad/p9VjJvdF1Q/FfUGSG1+gioGXgUoW+NFRcVvZDzVP0QKzA== X-Received: by 2002:a05:7300:a897:b0:304:9b48:53d8 with SMTP id 5a478bee46e88-30c0702c5ddmr11700284eec.10.1782167236649; Mon, 22 Jun 2026 15:27:16 -0700 (PDT) Received: from ?IPv6:2a03:83e0:115c:1:c4f4:7a34:78e2:a600? ([2620:10d:c090:500::2:e8d1]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30c1ba1f8b2sm12054660eec.4.2026.06.22.15.27.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jun 2026 15:27:16 -0700 (PDT) Message-ID: Subject: Re: [PATCH bpf-next v3 1/2] bpf: Reject offset refcount acquire arguments From: Eduard Zingerman To: Yiyang Chen , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kumar Kartikeya Dwivedi Cc: John Fastabend , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Shuah Khan , Viktor Malik , Leon Hwang , Dave Marchevsky , bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Date: Mon, 22 Jun 2026 15:27:14 -0700 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.60.1 (3.60.1-1.fc44) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Mon, 2026-06-22 at 02:25 +0000, Yiyang Chen wrote: > bpf_refcount_acquire() increments the refcount at the caller-supplied > pointer plus the refcount field offset, then returns the caller-supplied > pointer unchanged. >=20 > The verifier records the return value as a base pointer to the refcounted > object. >=20 > bpf_list_pop_front() and bpf_rbtree_remove() can return embedded > graph-node pointers as PTR_TO_BTF_ID | MEM_ALLOC with a fixed offset equa= l > to the node field offset. Passing such a pointer directly to > bpf_refcount_acquire() currently passes the refcounted-kptr type check. >=20 > That makes the runtime operation start from base + node_off while the > verifier models the returned pointer as the object base. >=20 > Require refcount-acquire arguments to have zero fixed offset by carrying > the requirement through check_func_arg_reg_off() to __check_ptr_off_reg()= . > Programs can still acquire a refcount from a graph-node-derived pointer > after normalizing it with container_of(). >=20 > Fixes: 7c50b1cb76aca ("bpf: Add bpf_refcount_acquire kfunc") > Signed-off-by: Yiyang Chen > --- Acked-by: Eduard Zingerman This is a bit ugly, but I don't have alternative suggestions. [...] > @@ -12135,7 +12146,8 @@ static int check_kfunc_args(struct bpf_verifier_e= nv *env, struct bpf_kfunc_call_ > =20 > if (regno =3D=3D meta->release_regno) > arg_type |=3D OBJ_RELEASE; > - ret =3D check_func_arg_reg_off(env, reg, argno, arg_type); > + ret =3D __check_func_arg_reg_off(env, reg, argno, arg_type, > + btf_id_fixed_off_ok); Nit: line length limit is 100 characters. > if (ret < 0) > return ret; > =20