From: sashiko-bot@kernel.org
To: "Ihor Solodrai" <ihor.solodrai@linux.dev>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v4 5/6] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame
Date: Fri, 13 Nov 2026 21:57:22 +0000 [thread overview]
Message-ID: <sashiko-outbox-213751@kernel.org> (raw)
In-Reply-To: <20261113213921.1646681-6-ihor.solodrai@linux.dev>
Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] bpf: missing Fixes trailer for bpf_for_each_map_elem() array key
fix
--
commit 96799b25d62e44bb557604554c52bc9deffd87cf
Author: Ihor Solodrai <ihor.solodrai@linux.dev>
> bpf: Scope the bpf_for_each_map_elem() array key to the callback frame
>
> bpf_for_each_map_elem() passes array and per-CPU array callbacks the
> address of a key on the helper's stack.
>
> A callback can save that pointer in its context and dereference it
> after the helper returns. Loads through PTR_TO_MAP_KEY are not
> fault-protected, allowing a four-byte read-only leak of reused kernel
> stack.
>
> The verifier tracks the pointer's type and key size, but does not tie
> its lifetime to the callback invocation.
>
> Scope R2 to the callback frame in the array map callback setup so the
> key and its copies are invalidated on callback return. Leave hash keys
> and map values unchanged, since their storage is not callback-local.
>
> Reported-by: Nicholas Carlini <npc@anthropic.com>
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
[Severity: Low]
Should this include a Fixes tag for the commit that added array map
support to bpf_for_each_map_elem()?
Fixes: 06dcdcd4b9e8 ("bpf: Add arraymap support for bpf_for_each_map_elem() helper")
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261113213921.1646681-1-ihor.solodrai@linux.dev?part=5
next prev parent reply other threads:[~2026-11-13 21:57 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-13 21:39 [PATCH bpf-next v4 0/6] bpf: Scope callback arguments to their frame Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 1/6] bpf: Share map-backed callback register setup Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 2/6] bpf: Rely on callback frame initialization defaults Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 3/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame Ihor Solodrai
2026-11-13 22:09 ` sashiko-bot
2026-11-13 21:39 ` [PATCH bpf-next v4 4/6] selftests/bpf: Cover the user ringbuf callback dynptr lifetime Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 5/6] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame Ihor Solodrai
2026-11-13 21:57 ` sashiko-bot [this message]
2026-11-13 21:39 ` [PATCH bpf-next v4 6/6] selftests/bpf: Cover callback-frame map key lifetime Ihor Solodrai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-213751@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.