Re: [PATCH bpf v5 1/2] bpf: Fix packet pointer invalidation for skb dynptr writes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Use-After-Free due to lost packet-ness for ARG_PTR_TO_MEM in global subprograms
--

commit 92dda8a7f4645930c007cf11da0767480bfbc820
Author: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>

bpf: Fix packet pointer invalidation for skb dynptr writes

This commit fixes a missing packet pointer invalidation bug for skb dynptrs.
It adds conservative static CFG predicates to track when global subprograms
might modify packet data through dynptrs, ensuring proper caller-side
invalidation.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -18763,6 +18875,7 @@ static int do_check_common(struct bpf_verifier_env *env, int subprog)
>  			} else if (arg->arg_type == (ARG_PTR_TO_DYNPTR | MEM_RDONLY)) {
>  				/* assume unspecial LOCAL dynptr type */
>  				__mark_dynptr_reg(reg, BPF_DYNPTR_TYPE_LOCAL, true, ++env->id_gen);
> +				reg->dynptr.may_be_pkt_data = true;
>  			} else if (base_type(arg->arg_type) == ARG_PTR_TO_MEM) {
>  				reg->type = PTR_TO_MEM;
>  				reg->type |= arg->arg_type &

[Severity: Critical]
This is a pre-existing issue, but does this generic memory pointer need
similar packet-ness tracking to prevent a use-after-free regression?

When a global subprogram expects a pointer to a sized type, it is
categorized as ARG_PTR_TO_MEM. The caller might pass a direct packet
pointer or a packet-backed dynptr slice, which is allowed if bounds checks
are satisfied.

Because the register state is zero-initialized and not explicitly updated
here, the dynptr_may_be_pkt_data flag remains false. If the subprogram
then calls a packet-reallocating helper like bpf_xdp_adjust_head(), the
clear_all_pkt_pointers() routine might fail to invalidate this register
since reg_is_dynptr_slice_pkt() would return false.

Can the subprogram then continue to access the reallocated and freed packet
memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1781539813.git.chenyy23@mails.tsinghua.edu.cn?part=1