All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH bpf-next v4 0/6] bpf: Scope callback arguments to their frame
@ 2026-11-13 21:39 Ihor Solodrai
  2026-11-13 21:39 ` [PATCH bpf-next v4 1/6] bpf: Share map-backed callback register setup Ihor Solodrai
                   ` (5 more replies)
  0 siblings, 6 replies; 9+ messages in thread
From: Ihor Solodrai @ 2026-11-13 21:39 UTC (permalink / raw)
  To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
	Eduard Zingerman, Kumar Kartikeya Dwivedi
  Cc: Amery Hung, Emil Tsalapatis, Nicholas Carlini, bpf, linux-kernel,
	kernel-team

A callback-calling helper can pass its callback a pointer that is only
valid for the callback invocation, and the verifier has no way to
express that lifetime.

Two helpers need fixing:

  * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a
    sample it releases as soon as the callback returns. Saving this
    pointer in callback_ctx leaves it pointing into reused kernel
    stack and allows arbitrary kernel read and write since v7.3.

  * bpf_for_each_map_elem() over an array or per-CPU array map passes
    the address of a u32 held in bpf_for_each_array_elem()'s own frame,
    leaking four bytes of kernel stack.

Give the callback frame an id and make it both the id and the
parent_id of such an argument, so that slices and clones descend from
it. Invalidate the id and its descendants when the frame is popped.

---

v3->v4:
  * Rebase on bpf-next and include the callback setter cleanups [1] as
    patches 1-2 (Alexei)
  * Pair frame_id in join_func(), and add a selftest for it
  * Drop the Fixes: tags and Cc: stable
v3: https://lore.kernel.org/r/20261106231157.2840635-1-ihor.solodrai@linux.dev

v2->v3:
  * Replace REF_TYPE_FRAME with a frame_id in bpf_func_state and drop
    the preparation and refactoring patches (Alexei)
  * Rebase on bpf, and add Fixes: tags
v2: https://lore.kernel.org/r/20261009202759.50520-1-ihor.solodrai@linux.dev

v1->v2:
  * Add the refactoring patches: release frame references in one scan,
    and fold diagnostics into the REF_TYPE_FRAME introduction
  * Replace temporary argument mask and deferred register scan with
    reference acquisition directly in the owning verifier state during
    callback setup (Eduard)
  * Reuse callback_park_dynptr() for the nested drain test
v1: https://lore.kernel.org/r/20260922010333.1226537-1-ihor.solodrai@linux.dev

[1] https://lore.kernel.org/r/20261106232110.2867412-1-ihor.solodrai@linux.dev

---

Ihor Solodrai (6):
  bpf: Share map-backed callback register setup
  bpf: Rely on callback frame initialization defaults
  bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame
  selftests/bpf: Cover the user ringbuf callback dynptr lifetime
  bpf: Scope the bpf_for_each_map_elem() array key to the callback frame
  selftests/bpf: Cover callback-frame map key lifetime

 include/linux/bpf.h                           |   2 +
 include/linux/bpf_verifier.h                  |   2 +
 kernel/bpf/arraymap.c                         |  19 ++-
 kernel/bpf/join.c                             |   3 +
 kernel/bpf/states.c                           |   3 +
 kernel/bpf/verifier.c                         | 128 ++++----------
 .../selftests/bpf/progs/user_ringbuf_fail.c   | 161 ++++++++++++++++++
 .../bpf/progs/verifier_iterating_callbacks.c  |  91 ++++++++++
 8 files changed, 316 insertions(+), 93 deletions(-)


base-commit: 0021f17128de5dc0b19f1a523f448df2440d8088
-- 
2.56.0


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-11-13 22:09 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-13 21:39 [PATCH bpf-next v4 0/6] bpf: Scope callback arguments to their frame Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 1/6] bpf: Share map-backed callback register setup Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 2/6] bpf: Rely on callback frame initialization defaults Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 3/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame Ihor Solodrai
2026-11-13 22:09   ` sashiko-bot
2026-11-13 21:39 ` [PATCH bpf-next v4 4/6] selftests/bpf: Cover the user ringbuf callback dynptr lifetime Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 5/6] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame Ihor Solodrai
2026-11-13 21:57   ` sashiko-bot
2026-11-13 21:39 ` [PATCH bpf-next v4 6/6] selftests/bpf: Cover callback-frame map key lifetime Ihor Solodrai

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.