Re: [PATCH bpf v1 0/4] bpf: Scope callback arguments to their frame

[Ihor Solodrai <ihor.solodrai@linux.dev>]

On 11/6/26 4:11 PM, Ihor Solodrai wrote:
> [...]
> 
> Ihor Solodrai (4):
>   bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame
>   selftests/bpf: Cover the user ringbuf callback dynptr lifetime
>   bpf: Scope the bpf_for_each_map_elem() array key to the callback frame
>   selftests/bpf: Cover callback-frame map key lifetime

Alexei, if this lands first, your pending verifier rewrite will need a
hunk like the one pasted below. Or the other way around.

Without it, a join can link a value to the wrong callback frame.

diff --git a/kernel/bpf/join.c b/kernel/bpf/join.c
index cc4494aef187..92b94e18c873 100644
--- a/kernel/bpf/join.c
+++ b/kernel/bpf/join.c
@@ -464,6 +464,9 @@ static bool join_func(struct bpf_join_state *js, struct bpf_func_state *fd,
 			return false;
 		if (!join_loop_stack(fa, fb))
 			return false;
+		jid_note(js, fa->frame_id, fb->frame_id, true);
+	} else if (!jid_strict_ok(js, fa->frame_id, fb->frame_id)) {
+		return false;
 	}
 
 	for (i = 0; i < MAX_BPF_REG; i++) {

> 
>  include/linux/bpf.h                           |   2 +
>  include/linux/bpf_verifier.h                  |   2 +
>  kernel/bpf/arraymap.c                         |  19 ++-
>  kernel/bpf/states.c                           |   3 +
>  kernel/bpf/verifier.c                         |  16 +++
>  .../selftests/bpf/progs/user_ringbuf_fail.c   | 135 ++++++++++++++++++
>  .../bpf/progs/verifier_iterating_callbacks.c  |  91 ++++++++++++
>  7 files changed, 266 insertions(+), 2 deletions(-)
> 
> 
> base-commit: 475a0cfd02f14d764023e926ac01fc7597134229