Re: [PATCH bpf-next v3 0/9] Refactor verifier object relationship tracking

Andrii Nakryiko
2026-04-24T00:04:19Z

On Tue, Apr 21, 2026 at 3:10 PM Amery Hung <ameryhung@gmail.com> wrote:
>
> Hi all,
>
> This patchset cleans up dynptr handling, refactors object relationship
> tracking in the verifier by introducing parent_id, and fixes dynptr
> use-after-free bugs where file/skb dynptrs are not invalidated when
> the parent referenced object is freed.
>
>
> * Motivation *
>

Very nice and approachable cover letter, thanks for improving it!

> In BPF qdisc programs, an skb can be freed through kfuncs. However,
> since dynptr does not track the parent referenced object (e.g., skb),
> the verifier does not invalidate the dynptr after the skb is freed,
> resulting in use-after-free. The same issue also affects file dynptr.
> …