[PATCH bpf-next v4 0/2] bpf: add bpf_dynptr_memset() kfunc

[PATCH bpf-next v4 0/2] bpf: add bpf_dynptr_memset() kfunc

[Ihor Solodrai]

Implement bpf_dynptr_memset() kfunc and add tests for it.

v3->v4:
  * do error checks after slice, nits
v2->v3:
  * nits and slow-path loop rewrite (Andrii)
  * simplify xdp chunks test (Mykyta) 
v1->v2:
  * handle non-linear buffers with bpf_dynptr_write()
  * change function signature to include offset arg
  * add more test cases

v3: https://lore.kernel.org/bpf/20250630212113.573097-1-isolodrai@meta.com/
v2: https://lore.kernel.org/bpf/20250624205240.1311453-1-isolodrai@meta.com/
v1: https://lore.kernel.org/bpf/20250618223310.3684760-1-isolodrai@meta.com/

Ihor Solodrai (2):
  bpf: add bpf_dynptr_memset() kfunc
  selftests/bpf: add test cases for bpf_dynptr_memset()

 kernel/bpf/helpers.c                          |  47 ++++++
 .../testing/selftests/bpf/prog_tests/dynptr.c |   8 +
 .../selftests/bpf/progs/dynptr_success.c      | 158 ++++++++++++++++++
 3 files changed, 213 insertions(+)

-- 
2.47.1

[PATCH bpf-next v4 1/2] bpf: add bpf_dynptr_memset() kfunc

[Ihor Solodrai]

Currently there is no straightforward way to fill dynptr memory with a
value (most commonly zero). One can do it with bpf_dynptr_write(), but
a temporary buffer is necessary for that.

Implement bpf_dynptr_memset() - an analogue of memset() from libc.

Signed-off-by: Ihor Solodrai <isolodrai@meta.com>
---
 kernel/bpf/helpers.c | 47 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index f48fa3fe8dec..5269381d6d3d 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -2907,6 +2907,52 @@ __bpf_kfunc int bpf_dynptr_copy(struct bpf_dynptr *dst_ptr, u32 dst_off,
 	return 0;
 }
 
+/**
+ * bpf_dynptr_memset() - Fill dynptr memory with a constant byte.
+ * @p: Destination dynptr - where data will be filled
+ * @offset: Offset into the dynptr to start filling from
+ * @size: Number of bytes to fill
+ * @val: Constant byte to fill the memory with
+ *
+ * Fills the @size bytes of the memory area pointed to by @p
+ * at @offset with the constant byte @val.
+ * Returns 0 on success; negative error, otherwise.
+ */
+ __bpf_kfunc int bpf_dynptr_memset(struct bpf_dynptr *p, u32 offset, u32 size, u8 val)
+ {
+	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;
+	u32 chunk_sz, write_off;
+	char buf[256];
+	void* slice;
+	int err;
+
+	slice = bpf_dynptr_slice_rdwr(p, offset, NULL, size);
+	if (likely(slice)) {
+		memset(slice, val, size);
+		return 0;
+	}
+
+	if (__bpf_dynptr_is_rdonly(ptr))
+		return -EINVAL;
+
+	err = bpf_dynptr_check_off_len(ptr, offset, size);
+	if (err)
+		return err;
+
+	/* Non-linear data under the dynptr, write from a local buffer */
+	chunk_sz = min_t(u32, sizeof(buf), size);
+	memset(buf, val, chunk_sz);
+
+	for (write_off = 0; write_off < size; write_off += chunk_sz) {
+		chunk_sz = min_t(u32, sizeof(buf), size - write_off);
+		err = __bpf_dynptr_write(ptr, offset + write_off, buf, chunk_sz, 0);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
 __bpf_kfunc void *bpf_cast_to_kern_ctx(void *obj)
 {
 	return obj;
@@ -3735,6 +3781,7 @@ BTF_ID_FLAGS(func, bpf_dynptr_is_rdonly)
 BTF_ID_FLAGS(func, bpf_dynptr_size)
 BTF_ID_FLAGS(func, bpf_dynptr_clone)
 BTF_ID_FLAGS(func, bpf_dynptr_copy)
+BTF_ID_FLAGS(func, bpf_dynptr_memset)
 #ifdef CONFIG_NET
 BTF_ID_FLAGS(func, bpf_modify_return_test_tp)
 #endif
-- 
2.47.1

[PATCH bpf-next v4 2/2] selftests/bpf: add test cases for bpf_dynptr_memset()

[Ihor Solodrai]

Add tests to verify the behavior of bpf_dynptr_memset():
  * normal memset 0
  * normal memset non-0
  * memset with an offset
  * memset in dynptr that was adjusted
  * error: size overflow
  * error: offset+size overflow
  * error: readonly dynptr
  * memset into non-linear xdp dynptr

Signed-off-by: Ihor Solodrai <isolodrai@meta.com>
---
 .../testing/selftests/bpf/prog_tests/dynptr.c |   8 +
 .../selftests/bpf/progs/dynptr_success.c      | 158 ++++++++++++++++++
 2 files changed, 166 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/dynptr.c b/tools/testing/selftests/bpf/prog_tests/dynptr.c
index 62e7ec775f24..f2b65398afce 100644
--- a/tools/testing/selftests/bpf/prog_tests/dynptr.c
+++ b/tools/testing/selftests/bpf/prog_tests/dynptr.c
@@ -21,6 +21,14 @@ static struct {
 	{"test_dynptr_data", SETUP_SYSCALL_SLEEP},
 	{"test_dynptr_copy", SETUP_SYSCALL_SLEEP},
 	{"test_dynptr_copy_xdp", SETUP_XDP_PROG},
+	{"test_dynptr_memset_zero", SETUP_SYSCALL_SLEEP},
+	{"test_dynptr_memset_notzero", SETUP_SYSCALL_SLEEP},
+	{"test_dynptr_memset_zero_offset", SETUP_SYSCALL_SLEEP},
+	{"test_dynptr_memset_zero_adjusted", SETUP_SYSCALL_SLEEP},
+	{"test_dynptr_memset_overflow", SETUP_SYSCALL_SLEEP},
+	{"test_dynptr_memset_overflow_offset", SETUP_SYSCALL_SLEEP},
+	{"test_dynptr_memset_readonly", SETUP_SKB_PROG},
+	{"test_dynptr_memset_xdp_chunks", SETUP_XDP_PROG},
 	{"test_ringbuf", SETUP_SYSCALL_SLEEP},
 	{"test_skb_readonly", SETUP_SKB_PROG},
 	{"test_dynptr_skb_data", SETUP_SKB_PROG},
diff --git a/tools/testing/selftests/bpf/progs/dynptr_success.c b/tools/testing/selftests/bpf/progs/dynptr_success.c
index a0391f9da2d4..7d7081d05d47 100644
--- a/tools/testing/selftests/bpf/progs/dynptr_success.c
+++ b/tools/testing/selftests/bpf/progs/dynptr_success.c
@@ -681,6 +681,164 @@ int test_dynptr_copy_xdp(struct xdp_md *xdp)
 	return XDP_DROP;
 }
 
+char memset_zero_data[] = "data to be zeroed";
+
+SEC("?tp/syscalls/sys_enter_nanosleep")
+int test_dynptr_memset_zero(void *ctx)
+{
+	__u32 data_sz = sizeof(memset_zero_data);
+	char zeroes[32] = {'\0'};
+	struct bpf_dynptr ptr;
+
+	err = bpf_dynptr_from_mem(memset_zero_data, data_sz, 0, &ptr);
+	err = err ?: bpf_dynptr_memset(&ptr, 0, data_sz, 0);
+	err = err ?: bpf_memcmp(zeroes, memset_zero_data, data_sz);
+
+	return 0;
+}
+
+#define DYNPTR_MEMSET_VAL 42
+
+char memset_notzero_data[] = "data to be overwritten";
+
+SEC("?tp/syscalls/sys_enter_nanosleep")
+int test_dynptr_memset_notzero(void *ctx)
+{
+	u32 data_sz = sizeof(memset_notzero_data);
+	struct bpf_dynptr ptr;
+	char expected[32];
+
+	__builtin_memset(expected, DYNPTR_MEMSET_VAL, data_sz);
+
+	err = bpf_dynptr_from_mem(memset_notzero_data, data_sz, 0, &ptr);
+	err = err ?: bpf_dynptr_memset(&ptr, 0, data_sz, DYNPTR_MEMSET_VAL);
+	err = err ?: bpf_memcmp(expected, memset_notzero_data, data_sz);
+
+	return 0;
+}
+
+char memset_zero_offset_data[] = "data to be zeroed partially";
+
+SEC("?tp/syscalls/sys_enter_nanosleep")
+int test_dynptr_memset_zero_offset(void *ctx)
+{
+	char expected[] = "data to \0\0\0\0eroed partially";
+	__u32 data_sz = sizeof(memset_zero_offset_data);
+	struct bpf_dynptr ptr;
+
+	err = bpf_dynptr_from_mem(memset_zero_offset_data, data_sz, 0, &ptr);
+	err = err ?: bpf_dynptr_memset(&ptr, 8, 4, 0);
+	err = err ?: bpf_memcmp(expected, memset_zero_offset_data, data_sz);
+
+	return 0;
+}
+
+char memset_zero_adjusted_data[] = "data to be zeroed partially";
+
+SEC("?tp/syscalls/sys_enter_nanosleep")
+int test_dynptr_memset_zero_adjusted(void *ctx)
+{
+	char expected[] = "data\0\0\0\0be zeroed partially";
+	__u32 data_sz = sizeof(memset_zero_adjusted_data);
+	struct bpf_dynptr ptr;
+
+	err = bpf_dynptr_from_mem(memset_zero_adjusted_data, data_sz, 0, &ptr);
+	err = err ?: bpf_dynptr_adjust(&ptr, 4, 8);
+	err = err ?: bpf_dynptr_memset(&ptr, 0, bpf_dynptr_size(&ptr), 0);
+	err = err ?: bpf_memcmp(expected, memset_zero_adjusted_data, data_sz);
+
+	return 0;
+}
+
+char memset_overflow_data[] = "memset overflow data";
+
+SEC("?tp/syscalls/sys_enter_nanosleep")
+int test_dynptr_memset_overflow(void *ctx)
+{
+	__u32 data_sz = sizeof(memset_overflow_data);
+	struct bpf_dynptr ptr;
+	int ret;
+
+	err = bpf_dynptr_from_mem(memset_overflow_data, data_sz, 0, &ptr);
+	ret = bpf_dynptr_memset(&ptr, 0, data_sz + 1, 0);
+	if (ret != -E2BIG)
+		err = 1;
+
+	return 0;
+}
+
+SEC("?tp/syscalls/sys_enter_nanosleep")
+int test_dynptr_memset_overflow_offset(void *ctx)
+{
+	__u32 data_sz = sizeof(memset_overflow_data);
+	struct bpf_dynptr ptr;
+	int ret;
+
+	err = bpf_dynptr_from_mem(memset_overflow_data, data_sz, 0, &ptr);
+	ret = bpf_dynptr_memset(&ptr, 1, data_sz, 0);
+	if (ret != -E2BIG)
+		err = 1;
+
+	return 0;
+}
+
+SEC("?cgroup_skb/egress")
+int test_dynptr_memset_readonly(struct __sk_buff *skb)
+{
+	struct bpf_dynptr ptr;
+	int ret;
+
+	err = bpf_dynptr_from_skb(skb, 0, &ptr);
+
+	/* cgroup skbs are read only, memset should fail */
+	ret = bpf_dynptr_memset(&ptr, 0, bpf_dynptr_size(&ptr), 0);
+	if (ret != -EINVAL)
+		err = 1;
+
+	return 0;
+}
+
+#define min_t(type, x, y) ({		\
+	type __x = (x);			\
+	type __y = (y);			\
+	__x < __y ? __x : __y; })
+
+SEC("xdp")
+int test_dynptr_memset_xdp_chunks(struct xdp_md *xdp)
+{
+	u32 data_sz, chunk_sz, offset = 0;
+	const int max_chunks = 200;
+	struct bpf_dynptr ptr_xdp;
+	char expected_buf[32];
+	char buf[32];
+	int i;
+
+	__builtin_memset(expected_buf, DYNPTR_MEMSET_VAL, sizeof(expected_buf));
+
+	/* ptr_xdp is backed by non-contiguous memory */
+	bpf_dynptr_from_xdp(xdp, 0, &ptr_xdp);
+	data_sz = bpf_dynptr_size(&ptr_xdp);
+
+	err = bpf_dynptr_memset(&ptr_xdp, 0, data_sz, DYNPTR_MEMSET_VAL);
+	if (err)
+		goto out;
+
+	bpf_for(i, 0, max_chunks) {
+		offset = i * sizeof(buf);
+		if (offset >= data_sz)
+			goto out;
+		chunk_sz = min_t(u32, sizeof(buf), data_sz - offset);
+		err = bpf_dynptr_read(&buf, chunk_sz, &ptr_xdp, offset, 0);
+		if (err)
+			goto out;
+		err = bpf_memcmp(buf, expected_buf, sizeof(buf));
+		if (err)
+			goto out;
+	}
+out:
+	return XDP_DROP;
+}
+
 void *user_ptr;
 /* Contains the copy of the data pointed by user_ptr.
  * Size 384 to make it not fit into a single kernel chunk when copying
-- 
2.47.1

Re: [PATCH bpf-next v4 2/2] selftests/bpf: add test cases for bpf_dynptr_memset()

[Mykyta Yatsenko]

On 7/2/25 22:03, Ihor Solodrai wrote:
> Add tests to verify the behavior of bpf_dynptr_memset():
>    * normal memset 0
>    * normal memset non-0
>    * memset with an offset
>    * memset in dynptr that was adjusted
>    * error: size overflow
>    * error: offset+size overflow
>    * error: readonly dynptr
>    * memset into non-linear xdp dynptr
>
> Signed-off-by: Ihor Solodrai <isolodrai@meta.com>
> ---
>   .../testing/selftests/bpf/prog_tests/dynptr.c |   8 +
>   .../selftests/bpf/progs/dynptr_success.c      | 158 ++++++++++++++++++
>   2 files changed, 166 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/dynptr.c b/tools/testing/selftests/bpf/prog_tests/dynptr.c
> index 62e7ec775f24..f2b65398afce 100644
> --- a/tools/testing/selftests/bpf/prog_tests/dynptr.c
> +++ b/tools/testing/selftests/bpf/prog_tests/dynptr.c
> @@ -21,6 +21,14 @@ static struct {
>   	{"test_dynptr_data", SETUP_SYSCALL_SLEEP},
>   	{"test_dynptr_copy", SETUP_SYSCALL_SLEEP},
>   	{"test_dynptr_copy_xdp", SETUP_XDP_PROG},
> +	{"test_dynptr_memset_zero", SETUP_SYSCALL_SLEEP},
> +	{"test_dynptr_memset_notzero", SETUP_SYSCALL_SLEEP},
> +	{"test_dynptr_memset_zero_offset", SETUP_SYSCALL_SLEEP},
> +	{"test_dynptr_memset_zero_adjusted", SETUP_SYSCALL_SLEEP},
> +	{"test_dynptr_memset_overflow", SETUP_SYSCALL_SLEEP},
> +	{"test_dynptr_memset_overflow_offset", SETUP_SYSCALL_SLEEP},
> +	{"test_dynptr_memset_readonly", SETUP_SKB_PROG},
> +	{"test_dynptr_memset_xdp_chunks", SETUP_XDP_PROG},
>   	{"test_ringbuf", SETUP_SYSCALL_SLEEP},
>   	{"test_skb_readonly", SETUP_SKB_PROG},
>   	{"test_dynptr_skb_data", SETUP_SKB_PROG},
> diff --git a/tools/testing/selftests/bpf/progs/dynptr_success.c b/tools/testing/selftests/bpf/progs/dynptr_success.c
> index a0391f9da2d4..7d7081d05d47 100644
> --- a/tools/testing/selftests/bpf/progs/dynptr_success.c
> +++ b/tools/testing/selftests/bpf/progs/dynptr_success.c
> @@ -681,6 +681,164 @@ int test_dynptr_copy_xdp(struct xdp_md *xdp)
>   	return XDP_DROP;
>   }
>   
> +char memset_zero_data[] = "data to be zeroed";
> +
> +SEC("?tp/syscalls/sys_enter_nanosleep")
> +int test_dynptr_memset_zero(void *ctx)
> +{
> +	__u32 data_sz = sizeof(memset_zero_data);
> +	char zeroes[32] = {'\0'};
> +	struct bpf_dynptr ptr;
> +
> +	err = bpf_dynptr_from_mem(memset_zero_data, data_sz, 0, &ptr);
> +	err = err ?: bpf_dynptr_memset(&ptr, 0, data_sz, 0);
> +	err = err ?: bpf_memcmp(zeroes, memset_zero_data, data_sz);
> +
> +	return 0;
> +}
> +
> +#define DYNPTR_MEMSET_VAL 42
> +
> +char memset_notzero_data[] = "data to be overwritten";
> +
> +SEC("?tp/syscalls/sys_enter_nanosleep")
> +int test_dynptr_memset_notzero(void *ctx)
> +{
> +	u32 data_sz = sizeof(memset_notzero_data);
> +	struct bpf_dynptr ptr;
> +	char expected[32];
> +
> +	__builtin_memset(expected, DYNPTR_MEMSET_VAL, data_sz);
> +
> +	err = bpf_dynptr_from_mem(memset_notzero_data, data_sz, 0, &ptr);
> +	err = err ?: bpf_dynptr_memset(&ptr, 0, data_sz, DYNPTR_MEMSET_VAL);
> +	err = err ?: bpf_memcmp(expected, memset_notzero_data, data_sz);
> +
> +	return 0;
> +}
> +
> +char memset_zero_offset_data[] = "data to be zeroed partially";
> +
> +SEC("?tp/syscalls/sys_enter_nanosleep")
> +int test_dynptr_memset_zero_offset(void *ctx)
> +{
> +	char expected[] = "data to \0\0\0\0eroed partially";
> +	__u32 data_sz = sizeof(memset_zero_offset_data);
> +	struct bpf_dynptr ptr;
> +
> +	err = bpf_dynptr_from_mem(memset_zero_offset_data, data_sz, 0, &ptr);
> +	err = err ?: bpf_dynptr_memset(&ptr, 8, 4, 0);
> +	err = err ?: bpf_memcmp(expected, memset_zero_offset_data, data_sz);
> +
> +	return 0;
> +}
> +
> +char memset_zero_adjusted_data[] = "data to be zeroed partially";
> +
> +SEC("?tp/syscalls/sys_enter_nanosleep")
> +int test_dynptr_memset_zero_adjusted(void *ctx)
> +{
> +	char expected[] = "data\0\0\0\0be zeroed partially";
> +	__u32 data_sz = sizeof(memset_zero_adjusted_data);
> +	struct bpf_dynptr ptr;
> +
> +	err = bpf_dynptr_from_mem(memset_zero_adjusted_data, data_sz, 0, &ptr);
> +	err = err ?: bpf_dynptr_adjust(&ptr, 4, 8);
> +	err = err ?: bpf_dynptr_memset(&ptr, 0, bpf_dynptr_size(&ptr), 0);
> +	err = err ?: bpf_memcmp(expected, memset_zero_adjusted_data, data_sz);
> +
> +	return 0;
> +}
> +
> +char memset_overflow_data[] = "memset overflow data";
> +
> +SEC("?tp/syscalls/sys_enter_nanosleep")
> +int test_dynptr_memset_overflow(void *ctx)
> +{
> +	__u32 data_sz = sizeof(memset_overflow_data);
> +	struct bpf_dynptr ptr;
> +	int ret;
> +
> +	err = bpf_dynptr_from_mem(memset_overflow_data, data_sz, 0, &ptr);
> +	ret = bpf_dynptr_memset(&ptr, 0, data_sz + 1, 0);
> +	if (ret != -E2BIG)
> +		err = 1;
> +
> +	return 0;
> +}
> +
> +SEC("?tp/syscalls/sys_enter_nanosleep")
> +int test_dynptr_memset_overflow_offset(void *ctx)
> +{
> +	__u32 data_sz = sizeof(memset_overflow_data);
> +	struct bpf_dynptr ptr;
> +	int ret;
> +
> +	err = bpf_dynptr_from_mem(memset_overflow_data, data_sz, 0, &ptr);
> +	ret = bpf_dynptr_memset(&ptr, 1, data_sz, 0);
> +	if (ret != -E2BIG)
> +		err = 1;
> +
> +	return 0;
> +}
> +
> +SEC("?cgroup_skb/egress")
> +int test_dynptr_memset_readonly(struct __sk_buff *skb)
> +{
> +	struct bpf_dynptr ptr;
> +	int ret;
> +
> +	err = bpf_dynptr_from_skb(skb, 0, &ptr);
> +
> +	/* cgroup skbs are read only, memset should fail */
> +	ret = bpf_dynptr_memset(&ptr, 0, bpf_dynptr_size(&ptr), 0);
> +	if (ret != -EINVAL)
> +		err = 1;
> +
> +	return 0;
> +}
> +
> +#define min_t(type, x, y) ({		\
> +	type __x = (x);			\
> +	type __y = (y);			\
> +	__x < __y ? __x : __y; })
> +
> +SEC("xdp")
> +int test_dynptr_memset_xdp_chunks(struct xdp_md *xdp)
> +{
> +	u32 data_sz, chunk_sz, offset = 0;
> +	const int max_chunks = 200;
> +	struct bpf_dynptr ptr_xdp;
> +	char expected_buf[32];
> +	char buf[32];
> +	int i;
> +
> +	__builtin_memset(expected_buf, DYNPTR_MEMSET_VAL, sizeof(expected_buf));
> +
> +	/* ptr_xdp is backed by non-contiguous memory */
> +	bpf_dynptr_from_xdp(xdp, 0, &ptr_xdp);
> +	data_sz = bpf_dynptr_size(&ptr_xdp);
> +
> +	err = bpf_dynptr_memset(&ptr_xdp, 0, data_sz, DYNPTR_MEMSET_VAL);
> +	if (err)
> +		goto out;
> +
> +	bpf_for(i, 0, max_chunks) {
> +		offset = i * sizeof(buf);
> +		if (offset >= data_sz)
> +			goto out;
> +		chunk_sz = min_t(u32, sizeof(buf), data_sz - offset);
> +		err = bpf_dynptr_read(&buf, chunk_sz, &ptr_xdp, offset, 0);
> +		if (err)
> +			goto out;
> +		err = bpf_memcmp(buf, expected_buf, sizeof(buf));
> +		if (err)
> +			goto out;
> +	}
> +out:
> +	return XDP_DROP;
> +}
> +
>   void *user_ptr;
>   /* Contains the copy of the data pointed by user_ptr.
>    * Size 384 to make it not fit into a single kernel chunk when copying
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>

Re: [PATCH bpf-next v4 0/2] bpf: add bpf_dynptr_memset() kfunc

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Wed, 2 Jul 2025 14:03:07 -0700 you wrote:
> Implement bpf_dynptr_memset() kfunc and add tests for it.
> 
> v3->v4:
>   * do error checks after slice, nits
> v2->v3:
>   * nits and slow-path loop rewrite (Andrii)
>   * simplify xdp chunks test (Mykyta)
> v1->v2:
>   * handle non-linear buffers with bpf_dynptr_write()
>   * change function signature to include offset arg
>   * add more test cases
> 
> [...]

Here is the summary with links:
  - [bpf-next,v4,1/2] bpf: add bpf_dynptr_memset() kfunc
    https://git.kernel.org/bpf/bpf-next/c/5fc5d8fded57
  - [bpf-next,v4,2/2] selftests/bpf: add test cases for bpf_dynptr_memset()
    https://git.kernel.org/bpf/bpf-next/c/7b29689263fb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html