From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Anton Protopopov" <a.s.protopopov@gmail.com>
Cc: <bpf@vger.kernel.org>, <daniel@iogearbox.net>,
<andrii@kernel.org>, <eddyz87@gmail.com>, <memxor@gmail.com>
Subject: Re: [PATCH v2 bpf-next 11/13] bpf: Mark the arguments of fmod_ret progs as PTR_UNTRUSTED
Date: Fri, 13 Nov 2026 16:30:05 +0000 [thread overview]
Message-ID: <DMU854VMCPXG.6LJLSEU82GMO@gmail.com> (raw)
In-Reply-To: <avbvzPFUFQOB4iYj@mail.gmail.com>
On Fri, Nov 13, 2026 at 03:09 AM Anton Protopopov <a.s.protopopov@gmail.com> wrote:
>> The arguments of fentry and fexit progs keep their type for now.
>
> I am not 100% following why this change is needed without enforcing
> this for fentry as well. One can attach fentry before fmodret and
> follow all the same args. (But in general, +1 for this and the
> following patches.)
Spot on question.
we've been talking about deprecating legacy PTR_TO_BTF_ID forever
and tried to do that several times, but there was always something in the way.
I did the analysis of all bpf open source programs I could find.
Turned out with these patches none of them fail
when we make only fmod_ret's args to be untrusted.
Of course, there is a chance of braking non-public progs.
Before this patch set the kernel has ~1200 fmod_ret targets.
After it will have ~12000 fmod_ret targets.
If we keep them legacy ptr_to_btf_id, we will have endless
slop from bots demonstrating how fmod_ret can crash the kernel.
But back to "why not fentry question"... having decompiler is so empowering :)
I'm thinking to add a step to analyze how all these fmod_rets access their args.
If BTF says it's a pointer and asm code just goes and reads through this
pointer without any checks, that's 99% likely a trusted pointer and will be
marked as such.
All other pointers will be untrusted. This way we can finally
remove legacy ptr_to_btf_id with minimal bpf prog breakage.
next prev parent reply other threads:[~2026-11-13 16:30 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-13 5:08 [PATCH v2 bpf-next 00/13] bpf: fmod_ret for each function that returns errors Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 01/13] selftests/bpf: Don't depend on the width of a BTF id in verifier_live_stack Alexei Starovoitov
2026-11-13 11:13 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 02/13] resolve_btfids: Read the code of an ELF file by address Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 03/13] resolve_btfids: Describe machine instructions with LLVM's MC layer Alexei Starovoitov
2026-11-13 11:45 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 04/13] resolve_btfids: Find the definitions that reach the return value Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 05/13] resolve_btfids: Tag the functions that return errors Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 06/13] resolve_btfids: Fold the constants of a select without a branch Alexei Starovoitov
2026-11-13 11:59 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 07/13] resolve_btfids: Say which registers an instruction reads Alexei Starovoitov
2026-11-13 12:03 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 08/13] resolve_btfids: Don't list an error that follows work on an argument Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:15 ` Alexei Starovoitov
2026-11-13 12:14 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 09/13] bpf: Allow fmod_ret on tagged functions and check the return value Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:17 ` Alexei Starovoitov
2026-11-13 12:20 ` Anton Protopopov
2026-11-13 16:17 ` Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 10/13] selftests/bpf: Test fmod_ret on tagged functions Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 11/13] bpf: Mark the arguments of fmod_ret progs as PTR_UNTRUSTED Alexei Starovoitov
2026-11-13 11:09 ` Anton Protopopov
2026-11-13 16:30 ` Alexei Starovoitov [this message]
2026-11-13 5:09 ` [PATCH v2 bpf-next 12/13] bpf: Treat the type of an untrusted pointer as a hint Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:33 ` Alexei Starovoitov
2026-11-13 5:09 ` [PATCH v2 bpf-next 13/13] selftests/bpf: Test untrusted pointers in fmod_ret progs Alexei Starovoitov
2026-11-13 13:00 ` [PATCH v2 bpf-next 00/13] bpf: fmod_ret for each function that returns errors Anton Protopopov
2026-11-13 16:37 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DMU854VMCPXG.6LJLSEU82GMO@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=a.s.protopopov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=memxor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.