From: Emil Tsalapatis <emil@etsalapatis.com>
To: bpf@vger.kernel.org
Cc: ast@kernel.org, andrii@kernel.org, eddyz87@gmail.com,
memxor@gmail.com, daniel@iogearbox.net, netdev@vger.kernel.org,
Emil Tsalapatis <emil@etsalapatis.com>
Subject: [PATCH bpf 11/11] selftests/bpf: Test dynptr slice invalidation on skb clobber
Date: Wed, 16 Sep 2026 05:08:29 +0000 [thread overview]
Message-ID: <20260916050830.8774-12-emil@etsalapatis.com> (raw)
In-Reply-To: <20260916050830.8774-1-emil@etsalapatis.com>
Add tests that ensure that dynptr slices backed by skb memory
are invalidated on any operation that potentially moves/frees
the backing skb memory. Also test that only skb-backed dynptrs
may invalidate pointers into skbs.
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
---
.../testing/selftests/bpf/progs/dynptr_fail.c | 183 ++++++++++++++++++
1 file changed, 183 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
index 1cd61d72c..0f030f397 100644
--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
+++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
@@ -13,6 +13,9 @@
char _license[] SEC("license") = "GPL";
+extern int bpf_dynptr_memset(const struct bpf_dynptr *p, __u64 offset, __u64 size,
+ __u8 val) __ksym __weak;
+
struct test_info {
int x;
struct bpf_dynptr ptr;
@@ -1274,6 +1277,186 @@ int skb_invalid_data_slice4(struct __sk_buff *skb)
return SK_PASS;
}
+/*
+ * A kfunc that may clobber packet pointers must invalidate skb data slices.
+ */
+SEC("?tc")
+__failure __msg("invalid mem access")
+int skb_invalid_data_slice_after_dynptr_memset(struct __sk_buff *skb)
+{
+ struct bpf_dynptr ptr;
+ struct ethhdr *hdr;
+ char buffer[sizeof(*hdr)] = {};
+
+ bpf_dynptr_from_skb(skb, 0, &ptr);
+
+ hdr = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, sizeof(buffer));
+ if (!hdr)
+ return SK_DROP;
+
+ bpf_dynptr_memset(&ptr, 0, 0, 0);
+
+ /* this should fail */
+ val = hdr->h_proto;
+
+ return SK_PASS;
+}
+
+/*
+ * A dynptr kfunc that may clobber packet pointers must not invalidate packet
+ * pointers when called with a non-skb dynptr.
+ */
+SEC("?tc")
+__success
+int pkt_ptr_valid_after_dynptr_memset_on_mem(struct __sk_buff *skb)
+{
+ struct bpf_dynptr ptr;
+ int *p = (void *)(long)skb->data;
+
+ if ((void *)(p + 1) > (void *)(long)skb->data_end)
+ return SK_DROP;
+
+ if (bpf_dynptr_from_mem(&val, sizeof(val), 0, &ptr))
+ return SK_DROP;
+
+ bpf_dynptr_memset(&ptr, 0, 0, 0);
+
+ return *p ? SK_PASS : SK_DROP;
+}
+
+__noinline
+int skb_dynptr_memset(struct __sk_buff *skb)
+{
+ struct bpf_dynptr ptr;
+
+ if (bpf_dynptr_from_skb(skb, 0, &ptr))
+ return 0;
+
+ return bpf_dynptr_memset(&ptr, 0, 0, 0);
+}
+
+/*
+ * A global subprog that may clobber packet pointers must invalidate packet
+ * pointers held by its caller.
+ */
+SEC("?tc")
+__failure __msg("invalid mem access")
+int skb_invalid_pkt_ptr_after_dynptr_memset_global(struct __sk_buff *skb)
+{
+ int *p = (void *)(long)skb->data;
+
+ if ((void *)(p + 1) > (void *)(long)skb->data_end)
+ return SK_DROP;
+
+ skb_dynptr_memset(skb);
+
+ /* this should fail */
+ val = *p;
+
+ return SK_PASS;
+}
+
+__noinline
+int skb_dynptr_memset_global_arg(struct __sk_buff *skb,
+ struct bpf_dynptr *ptr)
+{
+ int *p = (void *)(long)skb->data;
+
+ if ((void *)(p + 1) > (void *)(long)skb->data_end)
+ return SK_DROP;
+
+ bpf_dynptr_memset(ptr, 0, sizeof(*p), 0);
+
+ /* this should fail */
+ val = *p;
+
+ return SK_PASS;
+}
+
+/*
+ * A global subprog must conservatively treat a dynptr argument as possibly
+ * skb-backed when checking whether a kfunc invalidates packet pointers.
+ */
+SEC("?tc")
+__failure __msg("invalid mem access")
+int skb_invalid_pkt_ptr_after_dynptr_memset_global_arg(struct __sk_buff *skb)
+{
+ struct bpf_dynptr ptr;
+
+ if (bpf_dynptr_from_skb(skb, 0, &ptr))
+ return SK_DROP;
+
+ return skb_dynptr_memset_global_arg(skb, &ptr);
+}
+
+__noinline
+int skb_dynptr_write_global_arg(struct bpf_dynptr *ptr)
+{
+ int write_data = 0;
+
+ return bpf_dynptr_write(ptr, 0, &write_data, sizeof(write_data), 0);
+}
+
+/*
+ * A global subprog that calls bpf_dynptr_write() on a dynptr argument must
+ * invalidate packet pointers held by its caller.
+ */
+SEC("?tc")
+__failure __msg("invalid mem access")
+int skb_invalid_pkt_ptr_after_dynptr_write_global_arg(struct __sk_buff *skb)
+{
+ struct bpf_dynptr ptr;
+ int *p = (void *)(long)skb->data;
+
+ if ((void *)(p + 1) > (void *)(long)skb->data_end)
+ return SK_DROP;
+
+ if (bpf_dynptr_from_skb(skb, 0, &ptr))
+ return SK_DROP;
+
+ skb_dynptr_write_global_arg(&ptr);
+
+ /* this should fail */
+ val = *p;
+
+ return SK_PASS;
+}
+
+__noinline
+int skb_dynptr_write_global_arg_with_pkt_ptr(struct __sk_buff *skb,
+ struct bpf_dynptr *ptr)
+{
+ int write_data = 0;
+ int *p = (void *)(long)skb->data;
+
+ if ((void *)(p + 1) > (void *)(long)skb->data_end)
+ return SK_DROP;
+
+ bpf_dynptr_write(ptr, 0, &write_data, sizeof(write_data), 0);
+
+ /* this should fail */
+ val = *p;
+
+ return SK_PASS;
+}
+
+/*
+ * A global subprog must conservatively treat a dynptr argument as possibly
+ * skb-backed when checking whether bpf_dynptr_write() invalidates packet
+ * pointers in the callee.
+ */
+SEC("?tc")
+__failure __msg("invalid mem access")
+int skb_invalid_pkt_ptr_after_dynptr_write_global_arg_in_subprog(struct __sk_buff *skb)
+{
+ struct bpf_dynptr ptr;
+
+ if (bpf_dynptr_from_skb(skb, 0, &ptr))
+ return SK_DROP;
+
+ return skb_dynptr_write_global_arg_with_pkt_ptr(skb, &ptr);
+}
+
/* Read-only skb data slice is invalidated on write to skb metadata */
SEC("?tc")
__failure __msg("invalid mem access 'scalar'")
--
2.54.0
prev parent reply other threads:[~2026-09-16 5:08 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-16 5:08 [PATCH bpf 00/11] skb/arena bugfixes Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 01/11] bpf: Fix bounds check for skb-backed dynptrs Emil Tsalapatis
2026-09-16 11:52 ` Jiayuan Chen
2026-09-16 23:08 ` Jakub Kicinski
2026-09-16 5:08 ` [PATCH bpf 02/11] selftests/bpf: Test dynptr slices past end of skb Emil Tsalapatis
2026-09-16 5:18 ` sashiko-bot
2026-09-16 5:08 ` [PATCH bpf 03/11] bpf: Fix bpf_sock context code generation Emil Tsalapatis
2026-09-16 12:21 ` Jiayuan Chen
2026-09-16 5:08 ` [PATCH bpf 04/11] selftests/bpf: Add selftests for rx_queue_mapping context access Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 05/11] bpf: Reject pkt arguments in mutating subprogs Emil Tsalapatis
2026-09-16 5:57 ` Amery Hung
2026-09-16 5:58 ` Amery Hung
2026-09-16 18:41 ` Emil Tsalapatis
2026-09-16 19:26 ` Amery Hung
2026-09-16 5:08 ` [PATCH bpf 06/11] selftests/bpf: Test rejection of pkt args to " Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 07/11] bpf: Prevent variable arena/non-arena register contents Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 08/11] selftests/bpf: Test for mixed arena/nonarena code paths Emil Tsalapatis
2026-09-16 5:17 ` sashiko-bot
2026-09-16 5:08 ` [PATCH bpf 09/11] bpf: Track whether dynptr type is known Emil Tsalapatis
2026-09-16 5:22 ` sashiko-bot
2026-09-16 18:41 ` Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 10/11] bpf: Track skb memory invalidation by packet-backed dynptrs Emil Tsalapatis
2026-09-16 5:08 ` Emil Tsalapatis [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260916050830.8774-12-emil@etsalapatis.com \
--to=emil@etsalapatis.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.