From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: <bot+bpf-ci@kernel.org>, <bpf@vger.kernel.org>
Cc: <daniel@iogearbox.net>, <andrii@kernel.org>, <eddyz87@gmail.com>,
<memxor@gmail.com>, <a.s.protopopov@gmail.com>,
<martin.lau@kernel.org>, <yonghong.song@linux.dev>,
<mason@kernel.org>, <ihor.solodrai@linux.dev>
Subject: Re: [PATCH v2 bpf-next 12/13] bpf: Treat the type of an untrusted pointer as a hint
Date: Fri, 13 Nov 2026 16:33:49 +0000 [thread overview]
Message-ID: <DMU87ZLFC00R.263G7S4GQS8HX@gmail.com> (raw)
In-Reply-To: <cdadf16f205392dbca1eabedeb3123c4b4ff7512d74b4c7f52f4b6b8f671a48e@mail.kernel.org>
On Thu, Nov 12, 2026 at 09:52 PM bot+bpf-ci@kernel.org <bot+bpf-ci@kernel.org> wrote:
> Both tests reach the kernel type through bpf_core_cast(), so they hold an
> untrusted pointer, and a failed walk now gives a scalar instead of an
> error. The tests then only check that the walk does not crash, and no
> longer exercise the variable-offset logic in btf_struct_access() that the
> comments describe.
Right. flex_array_field() has the same pointer, so it cannot fail either.
arr_unaligned_step() still covers the stride check. Nothing covers the
'nelems == 0' check of the flexible tail now.
> Should these comments be updated to say what the tests check now? Or could
> the two flexible-array cases use a trusted kernel pointer, so that the
> stride check and the flexible-tail check in btf_struct_access() stay
> covered?
Will fix in v3: the three tests will take unix_sk->addr in iter/unix.
It's a plain PTR_TO_BTF_ID, so the two tests stay __failure.
next prev parent reply other threads:[~2026-11-13 16:33 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-13 5:08 [PATCH v2 bpf-next 00/13] bpf: fmod_ret for each function that returns errors Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 01/13] selftests/bpf: Don't depend on the width of a BTF id in verifier_live_stack Alexei Starovoitov
2026-11-13 11:13 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 02/13] resolve_btfids: Read the code of an ELF file by address Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 03/13] resolve_btfids: Describe machine instructions with LLVM's MC layer Alexei Starovoitov
2026-11-13 11:45 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 04/13] resolve_btfids: Find the definitions that reach the return value Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 05/13] resolve_btfids: Tag the functions that return errors Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 06/13] resolve_btfids: Fold the constants of a select without a branch Alexei Starovoitov
2026-11-13 11:59 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 07/13] resolve_btfids: Say which registers an instruction reads Alexei Starovoitov
2026-11-13 12:03 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 08/13] resolve_btfids: Don't list an error that follows work on an argument Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:15 ` Alexei Starovoitov
2026-11-13 12:14 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 09/13] bpf: Allow fmod_ret on tagged functions and check the return value Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:17 ` Alexei Starovoitov
2026-11-13 12:20 ` Anton Protopopov
2026-11-13 16:17 ` Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 10/13] selftests/bpf: Test fmod_ret on tagged functions Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 11/13] bpf: Mark the arguments of fmod_ret progs as PTR_UNTRUSTED Alexei Starovoitov
2026-11-13 11:09 ` Anton Protopopov
2026-11-13 16:30 ` Alexei Starovoitov
2026-11-13 5:09 ` [PATCH v2 bpf-next 12/13] bpf: Treat the type of an untrusted pointer as a hint Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:33 ` Alexei Starovoitov [this message]
2026-11-13 5:09 ` [PATCH v2 bpf-next 13/13] selftests/bpf: Test untrusted pointers in fmod_ret progs Alexei Starovoitov
2026-11-13 13:00 ` [PATCH v2 bpf-next 00/13] bpf: fmod_ret for each function that returns errors Anton Protopopov
2026-11-13 16:37 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DMU87ZLFC00R.263G7S4GQS8HX@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=a.s.protopopov@gmail.com \
--cc=andrii@kernel.org \
--cc=bot+bpf-ci@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=ihor.solodrai@linux.dev \
--cc=martin.lau@kernel.org \
--cc=mason@kernel.org \
--cc=memxor@gmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.