From: "Kumar Kartikeya Dwivedi" <memxor@gmail.com>
To: "Feng Yang" <yangfeng59949@163.com>, <kpsingh@kernel.org>,
<matt@bobrowski.net>, <song@kernel.org>, <jolsa@kernel.org>,
<ihor.solodrai@linux.dev>, <ast@kernel.org>,
<daniel@iogearbox.net>, <andrii@kernel.org>, <eddyz87@gmail.com>,
<martin.lau@linux.dev>, <yonghong.song@linux.dev>,
<emil@etsalapatis.com>, <rostedt@goodmis.org>,
<mhiramat@kernel.org>, <mathieu.desnoyers@efficios.com>
Cc: <bpf@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<linux-trace-kernel@vger.kernel.org>
Subject: Re: [PATCH v2 bpf-next 1/2] bpf: Reject bpf_skb_output() from return-side tracing
Date: Tue, 22 Sep 2026 04:15:13 +0200 [thread overview]
Message-ID: <DLLHE9PBLDU0.XQGEOQQIR4HV@gmail.com> (raw)
In-Reply-To: <20260922015417.130869-1-yangfeng59949@163.com>
On Tue Sep 22, 2026 at 3:54 AM CEST, Feng Yang wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
>
> BPF fexit programs run after the traced function returns, while their
> context still contains the original function argument values. A traced
> function is free to consume an skb argument before returning, so the
> pointer seen by fexit can already be stale.
>
> The verifier checks that the first argument to bpf_skb_output() has the
> BTF type of struct sk_buff, but that does not establish its lifetime.
> bpf_skb_event_output() then dereferences skb->len and can trigger a
> use-after-free.
>
> Do not expose bpf_skb_output() to tracing programs which can run after
> the target: fexit, fexit.multi, fsession and fsession.multi. Keep it
> available to fentry and other tracing attach types where it is already
> supported. fsession must be rejected because the same program runs on
> both entry and return and the verifier cannot prove that a helper call
> is entry-only.
>
> Fixes: fec56f5890d9 ("bpf: Introduce BPF trampoline")
> Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn>
> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
> Closes: https://lore.kernel.org/all/9d61b891-2d52-42b9-bc1a-ad963ccb675d@std.uestc.edu.cn/
> Signed-off-by: Yun Lu <luyun@kylinos.cn>
> Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
> ---
Sorry, this is not an acceptable fix. This negates usage of the function in all
fexit and fession attach points. Unless there is a simpler way to enumerate in
which attach points this helper should be disabled, it might not be worth doing
and leaving this be as is.
pw-bot: cr
> [...]
next prev parent reply other threads:[~2026-09-22 2:15 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-22 1:54 [PATCH v2 bpf-next 1/2] bpf: Reject bpf_skb_output() from return-side tracing Feng Yang
2026-09-22 1:54 ` [PATCH v2 bpf-next 2/2] selftests/bpf: Check bpf_skb_output() tracing restrictions Feng Yang
2026-09-22 2:46 ` bot+bpf-ci
2026-09-22 2:15 ` Kumar Kartikeya Dwivedi [this message]
2026-09-22 7:03 ` [PATCH v2 bpf-next 1/2] bpf: Reject bpf_skb_output() from return-side tracing Feng Yang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DLLHE9PBLDU0.XQGEOQQIR4HV@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=mathieu.desnoyers@efficios.com \
--cc=matt@bobrowski.net \
--cc=mhiramat@kernel.org \
--cc=rostedt@goodmis.org \
--cc=song@kernel.org \
--cc=yangfeng59949@163.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.