From: Eduard Zingerman <eddyz87@gmail.com>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: memxor@gmail.com, bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v2 2/6] bpf: Treat a fault prone PTR_TO_MEM as a pointer type mismatch
Date: Sun, 16 Aug 2026 12:44:06 -0700 [thread overview]
Message-ID: <b7cde4015bcdee1fded1ef47c1915187e8d9c459.camel@gmail.com> (raw)
In-Reply-To: <20260814215301.709827-2-daniel@iogearbox.net>
On Fri, 2026-08-14 at 23:52 +0200, Daniel Borkmann wrote:
> reg_type_mismatch_ok() enumerates the pointer types which must not
> silently share a BPF_LDX with a different one, since the type recorded
> for the insn drives a rewrite in bpf_convert_ctx_accesses().
>
> f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()") added
> PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED as another type in need of one,
> namely the BPF_PROBE_MEM rewrite, but did not add it there. Fix it by
> adding the missing case to reg_type_mismatch_ok(), so that a PTR_TO_MEM
> which may fault on deref is not mismatch ok anymore. The triage in
> save_aux_ptr_type() then merges them.
>
> Fixes: f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
> v1 -> v2:
> - new patch to address PTR_TO_MEM case differently (Eduard)
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
next prev parent reply other threads:[~2026-08-16 19:44 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-14 21:52 [PATCH bpf-next v2 1/6] bpf: Keep fault protection when merging pointer types Daniel Borkmann
2026-08-14 21:52 ` [PATCH bpf-next v2 2/6] bpf: Treat a fault prone PTR_TO_MEM as a pointer type mismatch Daniel Borkmann
2026-08-16 19:44 ` Eduard Zingerman [this message]
2026-08-14 21:52 ` [PATCH bpf-next v2 3/6] bpf: Reject a store through a fault prone pointer Daniel Borkmann
2026-08-14 22:40 ` bot+bpf-ci
2026-08-14 23:26 ` Daniel Borkmann
2026-08-16 19:54 ` Eduard Zingerman
2026-08-16 20:02 ` Eduard Zingerman
2026-08-14 21:52 ` [PATCH bpf-next v2 4/6] bpf: Rewrite any fault prone load out of a mem or btf_id pointer Daniel Borkmann
2026-08-16 20:06 ` Eduard Zingerman
2026-08-14 21:52 ` [PATCH bpf-next v2 5/6] selftests/bpf: Add tests for pointer type merge at a shared load Daniel Borkmann
2026-08-14 22:56 ` bot+bpf-ci
2026-08-14 23:35 ` Daniel Borkmann
2026-08-16 22:24 ` Eduard Zingerman
2026-08-16 22:32 ` Eduard Zingerman
2026-08-14 21:53 ` [PATCH bpf-next v2 6/6] selftests/bpf: Add tests for fault prone loads out of RCU pointers Daniel Borkmann
2026-08-14 22:03 ` sashiko-bot
2026-08-14 22:28 ` Daniel Borkmann
2026-08-16 22:24 ` Eduard Zingerman
2026-08-14 22:15 ` [PATCH bpf-next v2 1/6] bpf: Keep fault protection when merging pointer types sashiko-bot
2026-08-14 22:19 ` Daniel Borkmann
2026-08-16 19:42 ` Eduard Zingerman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b7cde4015bcdee1fded1ef47c1915187e8d9c459.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=memxor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).