From: Eduard Zingerman <eddyz87@gmail.com>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: memxor@gmail.com, bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v2 2/6] bpf: Treat a fault prone PTR_TO_MEM as a pointer type mismatch
Date: Sun, 16 Aug 2026 12:44:06 -0700 [thread overview]
Message-ID: <b7cde4015bcdee1fded1ef47c1915187e8d9c459.camel@gmail.com> (raw)
In-Reply-To: <20260814215301.709827-2-daniel@iogearbox.net>
On Fri, 2026-08-14 at 23:52 +0200, Daniel Borkmann wrote:
> reg_type_mismatch_ok() enumerates the pointer types which must not
> silently share a BPF_LDX with a different one, since the type recorded
> for the insn drives a rewrite in bpf_convert_ctx_accesses().
>
> f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()") added
> PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED as another type in need of one,
> namely the BPF_PROBE_MEM rewrite, but did not add it there. Fix it by
> adding the missing case to reg_type_mismatch_ok(), so that a PTR_TO_MEM
> which may fault on deref is not mismatch ok anymore. The triage in
> save_aux_ptr_type() then merges them.
>
> Fixes: f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
> v1 -> v2:
> - new patch to address PTR_TO_MEM case differently (Eduard)
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
next prev parent reply other threads:[~2026-08-16 19:44 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-14 21:52 [PATCH bpf-next v2 1/6] bpf: Keep fault protection when merging pointer types Daniel Borkmann
2026-08-14 21:52 ` [PATCH bpf-next v2 2/6] bpf: Treat a fault prone PTR_TO_MEM as a pointer type mismatch Daniel Borkmann
2026-08-16 19:44 ` Eduard Zingerman [this message]
2026-08-14 21:52 ` [PATCH bpf-next v2 3/6] bpf: Reject a store through a fault prone pointer Daniel Borkmann
2026-08-14 22:40 ` bot+bpf-ci
2026-08-14 23:26 ` Daniel Borkmann
2026-08-16 19:54 ` Eduard Zingerman
2026-08-16 20:02 ` Eduard Zingerman
2026-08-14 21:52 ` [PATCH bpf-next v2 4/6] bpf: Rewrite any fault prone load out of a mem or btf_id pointer Daniel Borkmann
2026-08-16 20:06 ` Eduard Zingerman
2026-08-14 21:52 ` [PATCH bpf-next v2 5/6] selftests/bpf: Add tests for pointer type merge at a shared load Daniel Borkmann
2026-08-14 22:56 ` bot+bpf-ci
2026-08-14 23:35 ` Daniel Borkmann
2026-08-16 22:24 ` Eduard Zingerman
2026-08-16 22:32 ` Eduard Zingerman
2026-08-14 21:53 ` [PATCH bpf-next v2 6/6] selftests/bpf: Add tests for fault prone loads out of RCU pointers Daniel Borkmann
2026-08-14 22:03 ` sashiko-bot
2026-08-14 22:28 ` Daniel Borkmann
2026-08-16 22:24 ` Eduard Zingerman
2026-08-14 22:15 ` [PATCH bpf-next v2 1/6] bpf: Keep fault protection when merging pointer types sashiko-bot
2026-08-14 22:19 ` Daniel Borkmann
2026-08-16 19:42 ` Eduard Zingerman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b7cde4015bcdee1fded1ef47c1915187e8d9c459.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=memxor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.