From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Anton Protopopov" <a.s.protopopov@gmail.com>
Cc: <bpf@vger.kernel.org>, <daniel@iogearbox.net>,
<andrii@kernel.org>, <eddyz87@gmail.com>, <memxor@gmail.com>
Subject: Re: [PATCH v2 bpf-next 11/13] bpf: Mark the arguments of fmod_ret progs as PTR_UNTRUSTED
Date: Fri, 13 Nov 2026 16:30:05 +0000 [thread overview]
Message-ID: <DMU854VMCPXG.6LJLSEU82GMO@gmail.com> (raw)
In-Reply-To: <avbvzPFUFQOB4iYj@mail.gmail.com>
On Fri, Nov 13, 2026 at 03:09 AM Anton Protopopov <a.s.protopopov@gmail.com> wrote:
>> The arguments of fentry and fexit progs keep their type for now.
>
> I am not 100% following why this change is needed without enforcing
> this for fentry as well. One can attach fentry before fmodret and
> follow all the same args. (But in general, +1 for this and the
> following patches.)
Spot on question.
we've been talking about deprecating legacy PTR_TO_BTF_ID forever
and tried to do that several times, but there was always something in the way.
I did the analysis of all bpf open source programs I could find.
Turned out with these patches none of them fail
when we make only fmod_ret's args to be untrusted.
Of course, there is a chance of braking non-public progs.
Before this patch set the kernel has ~1200 fmod_ret targets.
After it will have ~12000 fmod_ret targets.
If we keep them legacy ptr_to_btf_id, we will have endless
slop from bots demonstrating how fmod_ret can crash the kernel.
But back to "why not fentry question"... having decompiler is so empowering :)
I'm thinking to add a step to analyze how all these fmod_rets access their args.
If BTF says it's a pointer and asm code just goes and reads through this
pointer without any checks, that's 99% likely a trusted pointer and will be
marked as such.
All other pointers will be untrusted. This way we can finally
remove legacy ptr_to_btf_id with minimal bpf prog breakage.
next prev parent reply other threads:[~2026-11-13 16:30 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-13 5:08 [PATCH v2 bpf-next 00/13] bpf: fmod_ret for each function that returns errors Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 01/13] selftests/bpf: Don't depend on the width of a BTF id in verifier_live_stack Alexei Starovoitov
2026-11-13 11:13 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 02/13] resolve_btfids: Read the code of an ELF file by address Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 03/13] resolve_btfids: Describe machine instructions with LLVM's MC layer Alexei Starovoitov
2026-11-13 11:45 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 04/13] resolve_btfids: Find the definitions that reach the return value Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 05/13] resolve_btfids: Tag the functions that return errors Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 06/13] resolve_btfids: Fold the constants of a select without a branch Alexei Starovoitov
2026-11-13 11:59 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 07/13] resolve_btfids: Say which registers an instruction reads Alexei Starovoitov
2026-11-13 12:03 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 08/13] resolve_btfids: Don't list an error that follows work on an argument Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:15 ` Alexei Starovoitov
2026-11-13 12:14 ` Anton Protopopov
2026-11-13 5:08 ` [PATCH v2 bpf-next 09/13] bpf: Allow fmod_ret on tagged functions and check the return value Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:17 ` Alexei Starovoitov
2026-11-13 12:20 ` Anton Protopopov
2026-11-13 16:17 ` Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 10/13] selftests/bpf: Test fmod_ret on tagged functions Alexei Starovoitov
2026-11-13 5:08 ` [PATCH v2 bpf-next 11/13] bpf: Mark the arguments of fmod_ret progs as PTR_UNTRUSTED Alexei Starovoitov
2026-11-13 11:09 ` Anton Protopopov
2026-11-13 16:30 ` Alexei Starovoitov [this message]
2026-11-13 5:09 ` [PATCH v2 bpf-next 12/13] bpf: Treat the type of an untrusted pointer as a hint Alexei Starovoitov
2026-11-13 5:52 ` bot+bpf-ci
2026-11-13 16:33 ` Alexei Starovoitov
2026-11-13 5:09 ` [PATCH v2 bpf-next 13/13] selftests/bpf: Test untrusted pointers in fmod_ret progs Alexei Starovoitov
2026-11-13 13:00 ` [PATCH v2 bpf-next 00/13] bpf: fmod_ret for each function that returns errors Anton Protopopov
2026-11-13 16:37 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DMU854VMCPXG.6LJLSEU82GMO@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=a.s.protopopov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=memxor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox