Re: [PATCH bpf] bpf: tail calls do not modify packet data

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2025-11-03 at 09:56 +0100, Teichmann, Martin wrote:
> Dear Eduard,
> 
> thanks for the review!
> 
> > I don't think this is safe to do, consider the following example:
> > 
> >  main:
> >    p = pkt
> >    foo()
> >    use p
> > 
> >  foo: // assume that 'foo' is a static function (local subprogram)
> >    if (something) do tail call
> >    don't modify packet data
> 
> You are absolutely right, this would not work. This should actually
> be covered by tests... I'll write a test. I also already have an
> idea how to fix also this problem, and will come back to you once
> I'm done.
> 
> > Alexei vaguely remembers discussion about using decl_tag's to mark
> > maps containing programs that don't modify packet pointers.
> 
> I am actually against that, I think this would be the wrong way to
> go. In my use case, I have written a dispatcher for packets that
> tail call other programs depending on the content of the packet
> processed. These programs do change during runtime.
>
> Until now I had no restrictions on those programs, they could modify
> the packet or not, as they wished, as the code does not return at
> all anyways. Tagging the programs would only limit their usefulness,
> without giving any benefits.

The idea behind annotation was that map without annotation would only
allow programs that do not modify packet data as values, while map
with annotation would allow programs that do modify and those that
don't. So, for your use-case it would be sufficient to add annotations
to the map.

But really, I don't see that many options on the table:
a. Be conservative and assume that every tail call modifies packed data.
b. Use map annotations as described above.
c. Assume that the map is pre-filled before main program verification
   and infer the "allows packet modifying programs" property from
   programs already there, after which seal the property.

What do you suggest?