* [PATCH bpf-next] bpf: stub out skb metadata dynptr read/write ops when CONFIG_NET=n
@ 2025-08-27 10:48 Jakub Sitnicki
2025-08-27 16:05 ` Alexei Starovoitov
0 siblings, 1 reply; 3+ messages in thread
From: Jakub Sitnicki @ 2025-08-27 10:48 UTC (permalink / raw)
To: bpf, Martin KaFai Lau
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann, kernel-team,
netdev, kernel test robot
Kernel Test Robot reported a compiler warning - a null pointer may be
passed to memmove in __bpf_dynptr_{read,write} when building without
networking support.
The warning is correct from a static analysis standpoint, but not actually
reachable. Without CONFIG_NET, creating dynptrs to skb metadata is
impossible since the constructor kfunc is missing.
Fix this the same way as for skb and xdp data dynptrs. Add wrappers for
loading and storing bytes to skb metadata, and stub them out to return an
error when CONFIG_NET=n.
Fixes: 6877cd392bae ("bpf: Enable read/write access to skb metadata through a dynptr")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202508212031.ir9b3B6Q-lkp@intel.com/
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
---
include/linux/filter.h | 26 ++++++++++++++++++++++++++
kernel/bpf/helpers.c | 6 ++----
2 files changed, 28 insertions(+), 4 deletions(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 9092d8ea95c8..5b0d7c5824ac 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1779,6 +1779,20 @@ void *bpf_xdp_pointer(struct xdp_buff *xdp, u32 offset, u32 len);
void bpf_xdp_copy_buf(struct xdp_buff *xdp, unsigned long off,
void *buf, unsigned long len, bool flush);
void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset);
+
+static inline int __bpf_skb_meta_load_bytes(struct sk_buff *skb,
+ u32 offset, void *to, u32 len)
+{
+ memmove(to, bpf_skb_meta_pointer(skb, offset), len);
+ return 0;
+}
+
+static inline int __bpf_skb_meta_store_bytes(struct sk_buff *skb, u32 offset,
+ const void *from, u32 len)
+{
+ memmove(bpf_skb_meta_pointer(skb, offset), from, len);
+ return 0;
+}
#else /* CONFIG_NET */
static inline int __bpf_skb_load_bytes(const struct sk_buff *skb, u32 offset,
void *to, u32 len)
@@ -1818,6 +1832,18 @@ static inline void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset)
{
return NULL;
}
+
+static inline int __bpf_skb_meta_load_bytes(struct sk_buff *skb, u32 offset,
+ void *to, u32 len)
+{
+ return -EOPNOTSUPP;
+}
+
+static inline int __bpf_skb_meta_store_bytes(struct sk_buff *skb, u32 offset,
+ const void *from, u32 len)
+{
+ return -EOPNOTSUPP;
+}
#endif /* CONFIG_NET */
#endif /* __LINUX_FILTER_H__ */
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 401b4932cc49..85761e347190 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1778,8 +1778,7 @@ static int __bpf_dynptr_read(void *dst, u32 len, const struct bpf_dynptr_kern *s
case BPF_DYNPTR_TYPE_XDP:
return __bpf_xdp_load_bytes(src->data, src->offset + offset, dst, len);
case BPF_DYNPTR_TYPE_SKB_META:
- memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset), len);
- return 0;
+ return __bpf_skb_meta_load_bytes(src->data, src->offset + offset, dst, len);
default:
WARN_ONCE(true, "bpf_dynptr_read: unknown dynptr type %d\n", type);
return -EFAULT;
@@ -1839,8 +1838,7 @@ int __bpf_dynptr_write(const struct bpf_dynptr_kern *dst, u32 offset, void *src,
case BPF_DYNPTR_TYPE_SKB_META:
if (flags)
return -EINVAL;
- memmove(bpf_skb_meta_pointer(dst->data, dst->offset + offset), src, len);
- return 0;
+ return __bpf_skb_meta_store_bytes(dst->data, dst->offset + offset, src, len);
default:
WARN_ONCE(true, "bpf_dynptr_write: unknown dynptr type %d\n", type);
return -EFAULT;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: stub out skb metadata dynptr read/write ops when CONFIG_NET=n
2025-08-27 10:48 [PATCH bpf-next] bpf: stub out skb metadata dynptr read/write ops when CONFIG_NET=n Jakub Sitnicki
@ 2025-08-27 16:05 ` Alexei Starovoitov
2025-09-01 9:27 ` Jakub Sitnicki
0 siblings, 1 reply; 3+ messages in thread
From: Alexei Starovoitov @ 2025-08-27 16:05 UTC (permalink / raw)
To: Jakub Sitnicki
Cc: bpf, Martin KaFai Lau, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, kernel-team, Network Development,
kernel test robot
On Wed, Aug 27, 2025 at 3:48 AM Jakub Sitnicki <jakub@cloudflare.com> wrote:
>
> Kernel Test Robot reported a compiler warning - a null pointer may be
> passed to memmove in __bpf_dynptr_{read,write} when building without
> networking support.
>
> The warning is correct from a static analysis standpoint, but not actually
> reachable. Without CONFIG_NET, creating dynptrs to skb metadata is
> impossible since the constructor kfunc is missing.
>
> Fix this the same way as for skb and xdp data dynptrs. Add wrappers for
> loading and storing bytes to skb metadata, and stub them out to return an
> error when CONFIG_NET=n.
>
> Fixes: 6877cd392bae ("bpf: Enable read/write access to skb metadata through a dynptr")
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202508212031.ir9b3B6Q-lkp@intel.com/
> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
> ---
> include/linux/filter.h | 26 ++++++++++++++++++++++++++
> kernel/bpf/helpers.c | 6 ++----
> 2 files changed, 28 insertions(+), 4 deletions(-)
>
> diff --git a/include/linux/filter.h b/include/linux/filter.h
> index 9092d8ea95c8..5b0d7c5824ac 100644
> --- a/include/linux/filter.h
> +++ b/include/linux/filter.h
> @@ -1779,6 +1779,20 @@ void *bpf_xdp_pointer(struct xdp_buff *xdp, u32 offset, u32 len);
> void bpf_xdp_copy_buf(struct xdp_buff *xdp, unsigned long off,
> void *buf, unsigned long len, bool flush);
> void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset);
> +
> +static inline int __bpf_skb_meta_load_bytes(struct sk_buff *skb,
> + u32 offset, void *to, u32 len)
> +{
> + memmove(to, bpf_skb_meta_pointer(skb, offset), len);
> + return 0;
> +}
> +
> +static inline int __bpf_skb_meta_store_bytes(struct sk_buff *skb, u32 offset,
> + const void *from, u32 len)
> +{
> + memmove(bpf_skb_meta_pointer(skb, offset), from, len);
> + return 0;
> +}
> #else /* CONFIG_NET */
> static inline int __bpf_skb_load_bytes(const struct sk_buff *skb, u32 offset,
> void *to, u32 len)
> @@ -1818,6 +1832,18 @@ static inline void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset)
> {
> return NULL;
> }
> +
> +static inline int __bpf_skb_meta_load_bytes(struct sk_buff *skb, u32 offset,
> + void *to, u32 len)
> +{
> + return -EOPNOTSUPP;
> +}
> +
> +static inline int __bpf_skb_meta_store_bytes(struct sk_buff *skb, u32 offset,
> + const void *from, u32 len)
> +{
> + return -EOPNOTSUPP;
> +}
imo that's too much to shut up the warn.
Maybe make:
static inline void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset)
{
return NULL;
}
to return ERR_PTR(-EOPNOTSUPP);
instead?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: stub out skb metadata dynptr read/write ops when CONFIG_NET=n
2025-08-27 16:05 ` Alexei Starovoitov
@ 2025-09-01 9:27 ` Jakub Sitnicki
0 siblings, 0 replies; 3+ messages in thread
From: Jakub Sitnicki @ 2025-09-01 9:27 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: bpf, Martin KaFai Lau, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, kernel-team, Network Development,
kernel test robot
On Wed, Aug 27, 2025 at 09:05 AM -07, Alexei Starovoitov wrote:
> On Wed, Aug 27, 2025 at 3:48 AM Jakub Sitnicki <jakub@cloudflare.com> wrote:
>>
>> Kernel Test Robot reported a compiler warning - a null pointer may be
>> passed to memmove in __bpf_dynptr_{read,write} when building without
>> networking support.
>>
>> The warning is correct from a static analysis standpoint, but not actually
>> reachable. Without CONFIG_NET, creating dynptrs to skb metadata is
>> impossible since the constructor kfunc is missing.
>>
>> Fix this the same way as for skb and xdp data dynptrs. Add wrappers for
>> loading and storing bytes to skb metadata, and stub them out to return an
>> error when CONFIG_NET=n.
>>
>> Fixes: 6877cd392bae ("bpf: Enable read/write access to skb metadata through a dynptr")
>> Reported-by: kernel test robot <lkp@intel.com>
>> Closes: https://lore.kernel.org/oe-kbuild-all/202508212031.ir9b3B6Q-lkp@intel.com/
>> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
>> ---
>> include/linux/filter.h | 26 ++++++++++++++++++++++++++
>> kernel/bpf/helpers.c | 6 ++----
>> 2 files changed, 28 insertions(+), 4 deletions(-)
>>
>> diff --git a/include/linux/filter.h b/include/linux/filter.h
>> index 9092d8ea95c8..5b0d7c5824ac 100644
>> --- a/include/linux/filter.h
>> +++ b/include/linux/filter.h
>> @@ -1779,6 +1779,20 @@ void *bpf_xdp_pointer(struct xdp_buff *xdp, u32 offset, u32 len);
>> void bpf_xdp_copy_buf(struct xdp_buff *xdp, unsigned long off,
>> void *buf, unsigned long len, bool flush);
>> void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset);
>> +
>> +static inline int __bpf_skb_meta_load_bytes(struct sk_buff *skb,
>> + u32 offset, void *to, u32 len)
>> +{
>> + memmove(to, bpf_skb_meta_pointer(skb, offset), len);
>> + return 0;
>> +}
>> +
>> +static inline int __bpf_skb_meta_store_bytes(struct sk_buff *skb, u32 offset,
>> + const void *from, u32 len)
>> +{
>> + memmove(bpf_skb_meta_pointer(skb, offset), from, len);
>> + return 0;
>> +}
>> #else /* CONFIG_NET */
>> static inline int __bpf_skb_load_bytes(const struct sk_buff *skb, u32 offset,
>> void *to, u32 len)
>> @@ -1818,6 +1832,18 @@ static inline void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset)
>> {
>> return NULL;
>> }
>> +
>> +static inline int __bpf_skb_meta_load_bytes(struct sk_buff *skb, u32 offset,
>> + void *to, u32 len)
>> +{
>> + return -EOPNOTSUPP;
>> +}
>> +
>> +static inline int __bpf_skb_meta_store_bytes(struct sk_buff *skb, u32 offset,
>> + const void *from, u32 len)
>> +{
>> + return -EOPNOTSUPP;
>> +}
>
> imo that's too much to shut up the warn.
> Maybe make:
> static inline void *bpf_skb_meta_pointer(struct sk_buff *skb, u32 offset)
> {
> return NULL;
> }
>
> to return ERR_PTR(-EOPNOTSUPP);
>
> instead?
Much nicer. Thanks for the suggestion.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-09-01 9:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-27 10:48 [PATCH bpf-next] bpf: stub out skb metadata dynptr read/write ops when CONFIG_NET=n Jakub Sitnicki
2025-08-27 16:05 ` Alexei Starovoitov
2025-09-01 9:27 ` Jakub Sitnicki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).