From: sashiko-bot@kernel.org
To: "Ihor Solodrai" <ihor.solodrai@linux.dev>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v4 3/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame
Date: Fri, 13 Nov 2026 22:09:39 +0000 [thread overview]
Message-ID: <sashiko-outbox-213775@kernel.org> (raw)
In-Reply-To: <20261113213921.1646681-4-ihor.solodrai@linux.dev>
Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] bpf: missing Fixes trailer for commit 205715673844 in commit
message
--
commit 3259f9f888525f719a6f09fc51c44281ce232398
Author: Ihor Solodrai <ihor.solodrai@linux.dev>
> bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame
>
> The dynptr argument to a bpf_user_ringbuf_drain() callback points to a
> descriptor on the helper's stack. The descriptor and the sample it
> describes are valid only during that callback invocation.
>
> The callback can save the dynptr pointer, a slice, or a clone in the
> caller's frame and use it after the drain returns. An escaped descriptor
> pointer can allow arbitrary kernel read/write once the helper's stack
> is reused.
>
> The verifier assigns the dynptr a type and an id, but does not tie it
> or its descendants to the callback's lifetime.
>
> Give the callback frame an id and make it both the id and the parent_id
> of R1, then invalidate that id and everything derived from it when the
> frame is popped. R1 has to be its own parent: slices take the dynptr's
> id as their parent_id, and bpf_dynptr_data() clobbers R1, so with a
> separate dynptr id nothing would connect a slice to the frame.
>
> Pair the frame id in join_func() like any other id, so joining states
> from different callback frames cannot link a value to the wrong frame.
>
> Reported-by: Nicholas Carlini <npc@anthropic.com>
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
[Severity: Low]
As reported by bot+bpf-ci@kernel.org on v1 [1], this fixes a lifetime bug in
set_user_ringbuf_callback_state(). Should the commit message include a Fixes
tag?
Fixes: 205715673844 ("bpf: Add bpf_user_ringbuf_drain() helper")
[1] https://lore.kernel.org/r/1e8b758af3e2561b6b9d60b87866a3545432da526326c1ba303845f9cb1188b7@mail.kernel.org
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261113213921.1646681-1-ihor.solodrai@linux.dev?part=3
next prev parent reply other threads:[~2026-11-13 22:09 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-13 21:39 [PATCH bpf-next v4 0/6] bpf: Scope callback arguments to their frame Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 1/6] bpf: Share map-backed callback register setup Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 2/6] bpf: Rely on callback frame initialization defaults Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 3/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame Ihor Solodrai
2026-11-13 22:09 ` sashiko-bot [this message]
2026-11-13 21:39 ` [PATCH bpf-next v4 4/6] selftests/bpf: Cover the user ringbuf callback dynptr lifetime Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 5/6] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame Ihor Solodrai
2026-11-13 21:57 ` sashiko-bot
2026-11-13 21:39 ` [PATCH bpf-next v4 6/6] selftests/bpf: Cover callback-frame map key lifetime Ihor Solodrai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-213775@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.