From: Ihor Solodrai <ihor.solodrai@linux.dev>
To: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Amery Hung <ameryhung@gmail.com>,
Emil Tsalapatis <emil@etsalapatis.com>,
Nicholas Carlini <npc@anthropic.com>,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@meta.com
Subject: Re: [PATCH bpf v1 0/4] bpf: Scope callback arguments to their frame
Date: Fri, 6 Nov 2026 16:15:14 -0700 [thread overview]
Message-ID: <3702b4e9-bda9-45c5-8fac-392db6451823@linux.dev> (raw)
In-Reply-To: <20261106231157.2840635-1-ihor.solodrai@linux.dev>
On 11/6/26 4:11 PM, Ihor Solodrai wrote:
> A callback-calling helper can pass its callback a pointer that is only
> valid for the callback invocation, and the verifier has no way to
> express that lifetime.
>
> Two helpers need fixing:
>
> * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a
> sample it releases as soon as the callback returns. Saving this
> pointer in callback_ctx leaves it pointing into reused kernel
> stack and allows arbitrary kernel read and write since v7.3.
>
> * bpf_for_each_map_elem() over an array or per-CPU array map passes
> the address of a u32 held in bpf_for_each_array_elem()'s own frame,
> leaking four bytes of kernel stack.
>
> Give the callback frame an id and make it both the id and the
> parent_id of such an argument, so that slices and clones descend from
> it. Invalidate the id and its descendants when the frame is popped.
>
> ---
>
> v2->v3:
Sorry, I forgot -v3 when doing git format-patch
Should I resend, or is this fine?
> [...]
next prev parent reply other threads:[~2026-11-06 23:15 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-06 23:11 [PATCH bpf v1 0/4] bpf: Scope callback arguments to their frame Ihor Solodrai
2026-11-06 23:11 ` [PATCH bpf v1 1/4] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame Ihor Solodrai
2026-11-06 23:11 ` [PATCH bpf v1 2/4] selftests/bpf: Cover the user ringbuf callback dynptr lifetime Ihor Solodrai
2026-11-06 23:11 ` [PATCH bpf v1 3/4] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame Ihor Solodrai
2026-11-06 23:11 ` [PATCH bpf v1 4/4] selftests/bpf: Cover callback-frame map key lifetime Ihor Solodrai
2026-11-06 23:15 ` Ihor Solodrai [this message]
2026-11-06 23:22 ` [PATCH bpf v1 0/4] bpf: Scope callback arguments to their frame Kumar Kartikeya Dwivedi
2026-11-06 23:32 ` Ihor Solodrai
2026-11-07 3:40 ` Alexei Starovoitov
2026-11-12 20:57 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3702b4e9-bda9-45c5-8fac-392db6451823@linux.dev \
--to=ihor.solodrai@linux.dev \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=kernel-team@meta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=memxor@gmail.com \
--cc=npc@anthropic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.