All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH bpf-next v3 00/16] bpf: Memory safety, lifetime and locking fixes (followups)
@ 2026-10-17 23:09 Alexei Starovoitov
  2026-10-17 23:09 ` [PATCH bpf-next v3 01/16] bpf: Don't take a program with a target program for an iterator Alexei Starovoitov
                   ` (16 more replies)
  0 siblings, 17 replies; 21+ messages in thread
From: Alexei Starovoitov @ 2026-10-17 23:09 UTC (permalink / raw)
  To: bpf; +Cc: daniel, andrii, eddyz87, memxor, josef, mason

From: Alexei Starovoitov <ast@kernel.org>

The first 30 patches of v2 are applied. This is the rest of the series,
with what the reviews of v2 have found, and two fixes on top of patches
that are applied already. Most of the patches are from Josef.

Every bug was reproduced in a VM on top of bpf-next, on the kernel right
before and right after the patch that fixes it. The splats are in the
commit logs. That goes for what the reviews have found as well.

Programs that are attached to other programs:
  01 a tracing program with a target program passes for an iterator program
  02 extensions reach further into the context than their target
  04 extensions of functions that run sleepable
  11 extensions get the unclone prologue without an skb in R1

Lifetime of local storage, programs, sockets and devices:
  03 values of a dead owner are freed under sleepable programs
  05 the exception table of a program that still runs is not found
  06 BPF_PROG_TEST_RUN of sk_lookup uses the socket outside of RCU
  07 cpumap uses the device of a queued frame after it is gone

Dynptrs of packets, where a write can reallocate the head of the skb:
  08 kfuncs that write through a dynptr
  09 bpf_dynptr_write() in a global function
  10 a dynptr passed to a global function
  12 kfuncs that write through a dynptr do not unclone the skb
  13 the source of the write is a slice of the same skb
  14 overlapping source and destination in an skb
  15 overlapping source and destination in an xdp_buff
  16 slices as arguments of helpers that change the packet

Some of the fixes make the kernel refuse what it has accepted so far:

 - 01: a tracing program with BPF_TRACE_ITER cannot have a target program.
 - 02: an extension of a raw tracepoint, tracepoint or syscall program
   cannot be attached if it reaches further into the context than that
   program. A program that leaves the context to its extensions has to
   touch as much of it as they do.
 - 04: the main function of a sleepable program, and a global function that
   is called without the RCU read lock, cannot be extended. The
   summarization selftest is adjusted.
 - 08-10, 16: packet pointers and slices are invalidated in more places.
   That hits some programs which are harmless at run time. A program that
   keeps a packet pointer across a global function which only writes to a
   ringbuf dynptr is one example.
 - 11: an extension of a tc, lwt_xmit or sk_skb program that writes to
   packet data has to get the context as its first argument, and scalars
   beside it.

test_progs in its three flavors, test_maps and test_verifier show no new
failures. cpumask/test_insert_leave is flaky when the tests run in
parallel, with and without the series: its program does not check
is_test_task(), so any other fork in the system makes it fail.

veristat sees no difference for the 5691 programs of the selftests, nor for
the 466 programs of the sched_ext schedulers that BPF CI builds: same
verdicts, insns, states and stack depth.

v2 -> v3, after the reviews by sashiko and the BPF CI bot. The numbers in
brackets are those of v2:
 - rebased on top of patches 1-30
 - 01: new. A tracing program with attach_prog_fd got around [26].
 - 02: new. What [28] says of max_tp_access holds for max_ctx_offset too.
 - 03 [31]: map_free() took smap away from an element whose fields
   destroy() had left to the RCU Tasks Trace callback: they were leaked
 - 09 [37]: Fixes tag
 - 10 [38]: the dynptr of the bpf_user_ringbuf_drain() callback was taken
   for an argument of a global function
 - 11 [39]: look at the arguments only if there is a prologue. Extensions
   of XDP, sk_msg and sockopt programs were refused for no reason.
 - 14 [42], 16 [43]: commit logs
 - 15: new. XDP was missed in [42].
 - 05 [33], 07 [35]: no change. The symbols have to outlive the grace
   period, and an order 3 allocation per cpumap entry is fine.

Not in this version: the prologue of an extension can move the head of the
skb under the packet pointers of its caller, as sashiko has pointed out for
[39]. To count such an extension as one that changes packet data would
refuse what commit 7e40781cc8b7 ("bpf: verifier: Use target program's type
for access verifications") has made possible. That takes more thought.

v2: https://lore.kernel.org/bpf/20261017163745.3341787-1-alexei.starovoitov@gmail.com/
v1: https://lore.kernel.org/bpf/20261017012058.355787-1-alexei.starovoitov@gmail.com/

Alexei Starovoitov (6):
  bpf: Don't take a program with a target program for an iterator
  bpf: Don't let an extension reach further into the context than its
    target
  bpf: Don't take an extension for a function that runs sleepable
  bpf: Refuse the prologue for an extension that cannot take it
  bpf: Unclone the skb for kfuncs that write through a dynptr
  bpf: Use memmove() to store bytes in an xdp_buff

Josef Bacik (10):
  bpf: Keep values of a dead owner for sleepable programs
  bpf: Keep the symbols of a program until it has ended
  bpf: Use the socket of a sk_lookup test run under RCU
  bpf, cpumap: Hold the device of frames in the queue
  bpf: Drop packet pointers behind kfuncs writing an skb
  bpf: Let bpf_dynptr_write() mark a global function
  bpf: Don't take a dynptr argument for a local dynptr
  bpf: Follow the head if an skb is written from a slice
  bpf: Use memmove() to store bytes in an skb
  bpf: Refuse packet slices for packet-changing helpers

 include/linux/bpf.h                           |  2 +
 include/linux/bpf_verifier.h                  |  2 +
 kernel/bpf/bpf_iter.c                         |  6 +-
 kernel/bpf/bpf_local_storage.c                | 31 +++++--
 kernel/bpf/cfg.c                              |  4 +-
 kernel/bpf/core.c                             | 50 +++++++----
 kernel/bpf/cpumap.c                           | 35 ++++++--
 kernel/bpf/fixups.c                           | 25 ++++++
 kernel/bpf/map_in_map.c                       |  7 +-
 kernel/bpf/syscall.c                          | 18 +++-
 kernel/bpf/verifier.c                         | 90 +++++++++++++++++--
 net/bpf/test_run.c                            | 19 ++--
 net/core/filter.c                             | 28 +++++-
 .../selftests/bpf/prog_tests/summarization.c  | 21 ++---
 14 files changed, 265 insertions(+), 73 deletions(-)


base-commit: c058636f788f8751e419b407206516280226e568
-- 
2.55.0


^ permalink raw reply	[flat|nested] 21+ messages in thread
end of thread, other threads:[~2026-10-18  0:50 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-17 23:09 [PATCH bpf-next v3 00/16] bpf: Memory safety, lifetime and locking fixes (followups) Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 01/16] bpf: Don't take a program with a target program for an iterator Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 02/16] bpf: Don't let an extension reach further into the context than its target Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 03/16] bpf: Keep values of a dead owner for sleepable programs Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 04/16] bpf: Don't take an extension for a function that runs sleepable Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 05/16] bpf: Keep the symbols of a program until it has ended Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 06/16] bpf: Use the socket of a sk_lookup test run under RCU Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 07/16] bpf, cpumap: Hold the device of frames in the queue Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 08/16] bpf: Drop packet pointers behind kfuncs writing an skb Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 09/16] bpf: Let bpf_dynptr_write() mark a global function Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 10/16] bpf: Don't take a dynptr argument for a local dynptr Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 11/16] bpf: Refuse the prologue for an extension that cannot take it Alexei Starovoitov
2026-10-17 23:29   ` sashiko-bot
2026-10-18  0:35     ` Alexei Starovoitov
2026-10-17 23:41   ` bot+bpf-ci
2026-10-17 23:09 ` [PATCH bpf-next v3 12/16] bpf: Unclone the skb for kfuncs that write through a dynptr Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 13/16] bpf: Follow the head if an skb is written from a slice Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 14/16] bpf: Use memmove() to store bytes in an skb Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 15/16] bpf: Use memmove() to store bytes in an xdp_buff Alexei Starovoitov
2026-10-17 23:09 ` [PATCH bpf-next v3 16/16] bpf: Refuse packet slices for packet-changing helpers Alexei Starovoitov
2026-10-18  0:50 ` [PATCH bpf-next v3 00/16] bpf: Memory safety, lifetime and locking fixes (followups) patchwork-bot+netdevbpf

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.