From: Leon Hwang <leon.hwang@linux.dev>
To: Jiri Olsa <olsajiri@gmail.com>
Cc: bpf@vger.kernel.org, "Alexei Starovoitov" <ast@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Martin KaFai Lau" <martin.lau@linux.dev>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Song Liu" <song@kernel.org>,
"Yonghong Song" <yonghong.song@linux.dev>,
"John Fastabend" <john.fastabend@gmail.com>,
"KP Singh" <kpsingh@kernel.org>,
"Stanislav Fomichev" <sdf@fomichev.me>,
"Hao Luo" <haoluo@google.com>, "Shuah Khan" <shuah@kernel.org>,
"Feng Yang" <yangfeng@kylinos.cn>,
"Menglong Dong" <menglong8.dong@gmail.com>,
"Puranjay Mohan" <puranjay@kernel.org>,
"Björn Töpel" <bjorn@kernel.org>, "Pu Lehui" <pulehui@huawei.com>,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
netdev@vger.kernel.org, kernel-patches-bot@fb.com
Subject: Re: [PATCH bpf-next v3 3/6] bpf: Disallow !kprobe_write_ctx progs tail-calling kprobe_write_ctx progs
Date: Thu, 12 Mar 2026 21:39:03 +0800 [thread overview]
Message-ID: <14e9e301-38da-4800-a1a6-9913c8d3cbf9@linux.dev> (raw)
In-Reply-To: <abKZfhWs9Gojuvip@krava>
On 2026/3/12 18:46, Jiri Olsa wrote:
> On Thu, Mar 12, 2026 at 10:24:24AM +0800, Leon Hwang wrote:
>> On 12/3/26 06:45, Jiri Olsa wrote:
[...]
>>
>> Actually, without this patch, when "bpf_fentry_test1" runs, the arg "a"
>> will be updated as 0. Thus, bpf_prog_test_run_tracing() returns -EFAULT
>> instead of 0.
>>
>> bpf_prog_test_run_tracing()
>> |-->bpf_fentry_test1()
>> |-->dummy_kprobe()
>> |-->kprobe() /* via tail call */
>> |-->regs->di = 0;
>> return 1; /* instead of 2 */
>> return -EFAULT;
>>
>> Yep, the commit log is not clear to describe this abuse problem. Will
>> update it.
>
> ah right :-\ ok, I think we need to do the suggested one way check and
> that should prevent kprobes having writeable ctx
>
Yeah, will apply strict both-ways check. See
https://lore.kernel.org/bpf/8a3c7f14-b3d1-4208-acbd-76e5db6c5320@linux.dev/.
Thanks,
Leon
next prev parent reply other threads:[~2026-03-12 13:39 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-03 15:06 [PATCH bpf-next v3 0/6] bpf: Enhance __bpf_prog_map_compatible() Leon Hwang
2026-03-03 15:06 ` [PATCH bpf-next v3 1/6] bpf: Add fsession to verbose log in check_get_func_ip() Leon Hwang
2026-03-03 15:06 ` [PATCH bpf-next v3 2/6] bpf: Factor out bpf_map_owner_[init,matches]() helpers Leon Hwang
2026-03-03 15:06 ` [PATCH bpf-next v3 3/6] bpf: Disallow !kprobe_write_ctx progs tail-calling kprobe_write_ctx progs Leon Hwang
2026-03-03 16:01 ` bot+bpf-ci
2026-03-10 17:23 ` Kumar Kartikeya Dwivedi
2026-03-11 6:08 ` Leon Hwang
2026-03-11 9:21 ` Kumar Kartikeya Dwivedi
2026-03-11 15:44 ` Alexei Starovoitov
2026-03-11 16:00 ` Leon Hwang
2026-03-11 22:45 ` Jiri Olsa
2026-03-12 2:24 ` Leon Hwang
2026-03-12 10:46 ` Jiri Olsa
2026-03-12 13:39 ` Leon Hwang [this message]
2026-03-03 15:06 ` [PATCH bpf-next v3 4/6] bpf: Disallow !call_get_func_ip progs tail-calling call_get_func_ip progs Leon Hwang
2026-03-03 15:06 ` [PATCH bpf-next v3 5/6] bpf: Disallow !call_session_cookie progs tail-calling call_session_cookie progs Leon Hwang
2026-03-03 15:06 ` [PATCH bpf-next v3 6/6] selftests/bpf: Add tests to verify prog_array map compatibility Leon Hwang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=14e9e301-38da-4800-a1a6-9913c8d3cbf9@linux.dev \
--to=leon.hwang@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bjorn@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=kernel-patches-bot@fb.com \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=menglong8.dong@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=olsajiri@gmail.com \
--cc=pulehui@huawei.com \
--cc=puranjay@kernel.org \
--cc=sdf@fomichev.me \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=yangfeng@kylinos.cn \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox