Re: [PATCH bpf-next v2 19/23] bpf: Consolidate function call pkt_access validation

[Mahe Tardy <mahe.tardy@gmail.com>]

On Fri, Sep 11, 2026 at 03:04:11PM -0700, Amery Hung wrote:
> check_func_arg() checks whether a helper permits packet pointers before
> dispatching argument-specific memory validation. check_kfunc_args() has
> no equivalent check, even though kfunc memory arguments may be backed by
> packet data.
> 
> Move packet-access validation to check_helper_mem_access(), where the
> access direction is known and helper, kfunc, and global-subprogram memory
> arguments converge. Pass call metadata there so helpers continue to
> require bpf_func_proto::pkt_access, while writes through kfunc and global
> subprogram arguments use the program-type policy and set
> env->seen_direct_write.
> 
> Keep call metadata when variable-size memory disables raw mode by
> clearing arg_raw_mem.regno instead, and pass it through the map-key path
> as well.
> 
> This also makes kfunc and global-subprogram packet writes request the
> required writable-packet prologue and rejects them for program types
> that only support direct packet reads.

Hello, sorry I don't have the full context on this patch series but it
looks like this commit broke one of our programs on bpf-next, we have a
global function with the following signature in a cgroup_skb program:

	__attribute__((noinline)) int
	parse_something(struct __sk_buff *skb, __u16 off, char *data_start, ...)

that we call with data_start being skb->data + some_offset and now it
fails passing the verifier with:

	; ret = parse_something(skb, offset_start, data, ...); @ parser.h:131
	199: (bf) r2 = r8                     ; R2=scalar(id=5) R8=scalar(id=5)
	200: (57) r2 &= 65535                 ; R2=scalar(smin=smin32=0,smax=umax=smax32=umax32=0xffff,var_off=(0x0; 0xffff))
	201: (79) r1 = *(u64 *)(r10 -40)      ; R1=ctx() R10=fp0 fp-40=ctx()
	202: (bf) r3 = r7                     ; R3=pkt(r=1247,imm=1244) R7=pkt(r=1247,imm=1244)
	203: (b7) r4 = 0                      ; R4=0
	204: (85) call pc+776
	function access to the packet is not allowed
	Caller passes invalid args into func#3 ('parse_something')

And this is read-only access given it's cgroup_skb prog.

We can work around this by just passing the integer offset and re-doing
the whole skb->data + offset dance in the global function (we've been
already doing it in some other spots for function by function
verification) but I was wondering if this actually a regression or
expected, thanks.

> 
> Signed-off-by: Amery Hung <ameryhung@gmail.com>
> ---
>  kernel/bpf/verifier.c                         | 24 +++++++++----------
>  .../bpf/progs/verifier_helper_packet_access.c |  4 ++--
>  2 files changed, 13 insertions(+), 15 deletions(-)

[...]