[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <83977f81df181ba05a6388f3f542ec027ff44189.camel@gmail.com>
Date: Tue, 22 Jul 2025 11:46:24 -0700
From: Eduard Zingerman <eddyz87@...il.com>
To: Jakub Sitnicki <jakub@...udflare.com>, bpf@...r.kernel.org
Cc: Alexei Starovoitov <ast@...nel.org>, Andrii Nakryiko
<andrii@...nel.org>, Arthur Fabre <arthur@...hurfabre.com>, Daniel
Borkmann <daniel@...earbox.net>, Eric Dumazet <edumazet@...gle.com>, Jakub
Kicinski <kuba@...nel.org>, Jesper Dangaard Brouer <hawk@...nel.org>,
Jesse Brandeburg <jbrandeburg@...udflare.com>, Joanne Koong
<joannelkoong@...il.com>, Lorenzo Bianconi <lorenzo@...nel.org>, Martin
KaFai Lau <martin.lau@...ux.dev>, Toke
Høiland-Jørgensen <thoiland@...hat.com>, Yan Zhai
<yan@...udflare.com>, kernel-team@...udflare.com, netdev@...r.kernel.org,
Stanislav Fomichev <sdf@...ichev.me>
Subject: Re: [PATCH bpf-next v3 01/10] bpf: Add dynptr type for skb metadata
On Mon, 2025-07-21 at 12:52 +0200, Jakub Sitnicki wrote:
> Add a dynptr type, similar to skb dynptr, but for the skb metadata access.
>
> The dynptr provides an alternative to __sk_buff->data_meta for accessing
> the custom metadata area allocated using the bpf_xdp_adjust_meta() helper.
>
> More importantly, it abstracts away the fact where the storage for the
> custom metadata lives, which opens up the way to persist the metadata by
> relocating it as the skb travels through the network stack layers.
>
> A notable difference between the skb and the skb_meta dynptr is that writes
> to the skb_meta dynptr don't invalidate either skb or skb_meta dynptr
> slices, since they cannot lead to a skb->head reallocation.
>
> skb_meta dynptr ops are stubbed out and implemented by subsequent changes.
>
> Only the program types which can access __sk_buff->data_meta today are
> allowed to create a dynptr for skb metadata at the moment. We need to
> modify the network stack to persist the metadata across layers before
> opening up access to other BPF hooks.
>
> Signed-off-by: Jakub Sitnicki <jakub@...udflare.com>
> ---
Acked-by: Eduard Zingerman <eddyz87@...il.com>
> @@ -2274,7 +2278,8 @@ static bool reg_is_pkt_pointer_any(const struct bpf_reg_state *reg)
> static bool reg_is_dynptr_slice_pkt(const struct bpf_reg_state *reg)
> {
> return base_type(reg->type) == PTR_TO_MEM &&
> - (reg->type & DYNPTR_TYPE_SKB || reg->type & DYNPTR_TYPE_XDP);
> + (reg->type &
> + (DYNPTR_TYPE_SKB | DYNPTR_TYPE_XDP | DYNPTR_TYPE_SKB_META));
> }
Note: This function is used to identify pointers to packet data that
might be stale after call to one of the functions in list [1].
Once such pointers are identified, verifier would disallow
access through these pointers.
dynptr_from_skb_meta() is implemented as:
bpf_dynptr_init(ptr, skb, BPF_DYNPTR_TYPE_SKB_META, 0, skb_metadata_len(skb));
here any read or write goes through skb object, not a pointer derived from it.
Given above, is it still necessary to list DYNPTR_FROM_SKB_META here?
Or some functions from [1] can change skb_metadata_len(skb)?
[1] https://elixir.bootlin.com/linux/v6.15.7/source/net/core/filter.c#L7989
[...]
Powered by blists - more mailing lists