netdev - Re: [PATCH bpf-next v3 02/10] bpf: Enable read access to skb metadata with bpf_dynptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8734amyhpp.fsf@cloudflare.com>
Date: Wed, 23 Jul 2025 18:50:26 +0200
From: Jakub Sitnicki <jakub@...udflare.com>
To: Eduard Zingerman <eddyz87@...il.com>
Cc: bpf@...r.kernel.org,  Alexei Starovoitov <ast@...nel.org>,  Andrii
 Nakryiko <andrii@...nel.org>,  Arthur Fabre <arthur@...hurfabre.com>,
  Daniel Borkmann <daniel@...earbox.net>,  Eric Dumazet
 <edumazet@...gle.com>,  Jakub Kicinski <kuba@...nel.org>,  Jesper Dangaard
 Brouer <hawk@...nel.org>,  Jesse Brandeburg <jbrandeburg@...udflare.com>,
  Joanne Koong <joannelkoong@...il.com>,  Lorenzo Bianconi
 <lorenzo@...nel.org>,  Martin KaFai Lau <martin.lau@...ux.dev>,  Toke
 Høiland-Jørgensen <thoiland@...hat.com>,  Yan Zhai
 <yan@...udflare.com>,
  kernel-team@...udflare.com,  netdev@...r.kernel.org,  Stanislav Fomichev
 <sdf@...ichev.me>
Subject: Re: [PATCH bpf-next v3 02/10] bpf: Enable read access to skb
 metadata with bpf_dynptr_read

On Tue, Jul 22, 2025 at 11:49 AM -07, Eduard Zingerman wrote:
> On Mon, 2025-07-21 at 12:52 +0200, Jakub Sitnicki wrote:
>
> [...]
>
>> diff --git a/net/core/filter.c b/net/core/filter.c
>> index c17b628c08f5..4b787c56b220 100644
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -11978,6 +11978,18 @@ bpf_sk_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>>  	return func;
>>  }
>>  
>> +int bpf_skb_meta_load_bytes(const struct sk_buff *skb, u32 offset,
>> +			    void *dst, u32 len)
>> +{
>> +	u32 meta_len = skb_metadata_len(skb);
>> +
>> +	if (len > meta_len || offset > meta_len - len)
>> +		return -E2BIG; /* out of bounds */
>> +
>> +	memmove(dst, skb_metadata_end(skb) - meta_len + offset, len);
>> +	return 0;
>> +}
>> +
>
> Nit: is it possible to use bpf_skb_meta_pointer() here to avoid
>      duplicating range check in both bpf_skb_meta_load_bytes()
>      and bpf_skb_meta_store_bytes()?

This will be a nice refactor. Thanks!