From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Ihor Solodrai" <ihor.solodrai@linux.dev>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Kumar Kartikeya Dwivedi" <memxor@gmail.com>
Cc: "Amery Hung" <ameryhung@gmail.com>,
"Emil Tsalapatis" <emil@etsalapatis.com>,
"Nicholas Carlini" <npc@anthropic.com>, <bpf@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <kernel-team@meta.com>
Subject: Re: [PATCH bpf-next v1 0/6] bpf: Scope callback arguments to their frame
Date: Tue, 22 Sep 2026 01:55:06 +0000 [thread overview]
Message-ID: <DLLGYV7DI406.JRNDNAZ4S29I@gmail.com> (raw)
In-Reply-To: <20260922010333.1226537-1-ihor.solodrai@linux.dev>
On Mon, Sep 21, 2026 at 06:03 PM Ihor Solodrai <ihor.solodrai@linux.dev> wrote:
> Neither has a local fix: both arguments point into a helper's own
> frame, with nothing longer-lived to anchor them to.
It's the same problem as a pointer to callee's stack.
check_stack_write_fixed_off() deals with it like this:
if (state != cur && reg->type == PTR_TO_STACK) {
verbose(env, "cannot spill pointers to stack into stack frame of the caller\n");
return -EINVAL;
}
CONST_PTR_TO_DYNPTR wasn't spillable before 7.3, so nothing depends
on parking it in the caller's frame. Reject it there too ?
and then no need for REF_TYPE_FRAME complexity?
next prev parent reply other threads:[~2026-09-22 1:55 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-22 1:03 [PATCH bpf-next v1 0/6] bpf: Scope callback arguments to their frame Ihor Solodrai
2026-09-22 1:03 ` [PATCH bpf-next v1 1/6] bpf: Introduce REF_TYPE_FRAME in the verifier Ihor Solodrai
2026-09-22 2:01 ` bot+bpf-ci
2026-09-22 1:03 ` [PATCH bpf-next v1 2/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame Ihor Solodrai
2026-09-22 1:47 ` bot+bpf-ci
2026-09-22 1:03 ` [PATCH bpf-next v1 3/6] bpf: Name the callback in frame-release diagnostics Ihor Solodrai
2026-09-22 1:03 ` [PATCH bpf-next v1 4/6] selftests/bpf: Cover the user ringbuf callback dynptr lifetime Ihor Solodrai
2026-09-22 1:47 ` bot+bpf-ci
2026-09-22 1:03 ` [PATCH bpf-next v1 5/6] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame Ihor Solodrai
2026-09-22 1:03 ` [PATCH bpf-next v1 6/6] selftests/bpf: Cover callback-frame map key lifetime Ihor Solodrai
2026-09-22 1:47 ` bot+bpf-ci
2026-09-22 1:55 ` Alexei Starovoitov [this message]
2026-09-22 2:15 ` [PATCH bpf-next v1 0/6] bpf: Scope callback arguments to their frame Kumar Kartikeya Dwivedi
2026-09-22 6:13 ` Ihor Solodrai
2026-09-22 22:41 ` Andrii Nakryiko
2026-09-24 7:02 ` Eduard Zingerman
2026-09-24 7:18 ` Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DLLGYV7DI406.JRNDNAZ4S29I@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=kernel-team@meta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=memxor@gmail.com \
--cc=npc@anthropic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.