[PATCH bpf-next] bpf, verifier: Invalidate dynptr slices on skb_ext COW reallocation

[PATCH bpf-next] bpf, verifier: Invalidate dynptr slices on skb_ext COW reallocation

[Muhammad Bilal]

When bpf_dynptr_from_skb_ext() is invoked with BPF_SKB_EXT_F_CREATE, it
calls skb_ext_add(skb, SKB_EXT_BPF). On cloned or shared SKBs, this
performs a copy-on-write (COW) reallocation of skb->extensions via
skb_ext_maybe_cow(), dropping the reference count on the previous
extension buffer and freeing it if the count drops to zero.

However, bpf_is_kfunc_pkt_changing() does not include
KF_bpf_dynptr_from_skb_ext. As a result, the BPF verifier skips
clear_all_pkt_pointers(), leaving previously obtained PTR_TO_MEM
dynptr slices pointing to the old extension buffer marked as valid.
A BPF program can subsequently dereference the stale slice pointer,
resulting in a Use-After-Free (UAF) read/write on freed slab memory.

Fix this by:
1. Adding KF_bpf_dynptr_from_skb_ext to bpf_is_kfunc_pkt_changing() so
   that clear_all_pkt_pointers() is executed, invalidating any active
   dynptr slices across the COW reallocation.
2. Updating __bpf_skb_ext_store_bytes() to use skb_ext_add() instead of
   skb_ext_find(), ensuring that shared extension buffers are properly
   COWed before any byte mutations.

Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 kernel/bpf/verifier.c | 3 ++-
 net/core/filter.c     | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7aa47342dc65..4b584ec6ef2d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11243,7 +11243,8 @@ static bool is_kfunc_bpf_preempt_enable(struct bpf_kfunc_call_arg_meta *meta)
 
 bool bpf_is_kfunc_pkt_changing(struct bpf_kfunc_call_arg_meta *meta)
 {
-	return meta->func_id == special_kfunc_list[KF_bpf_xdp_pull_data];
+	return meta->func_id == special_kfunc_list[KF_bpf_xdp_pull_data] ||
+	       meta->func_id == special_kfunc_list[KF_bpf_dynptr_from_skb_ext];
 }
 
 static enum kfunc_ptr_arg_type
diff --git a/net/core/filter.c b/net/core/filter.c
index 11bb0d236822..a9a164738389 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -12290,7 +12290,7 @@ int __bpf_skb_ext_store_bytes(struct sk_buff *skb, u32 offset,
 	if (unlikely(flags))
 		return -EINVAL;
 
-	ext = skb_ext_find(skb, SKB_EXT_BPF);
+	ext = skb_ext_add(skb, SKB_EXT_BPF);
 	if (!ext)
 		return -ENOENT;
 
-- 
2.43.0