netdev - Re: [PATCH bpf-next v4 2/8] bpf: Enable read/write access to skb metadata through a dynptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250725073414.649ec615@kernel.org>
Date: Fri, 25 Jul 2025 07:34:14 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Jakub Sitnicki <jakub@...udflare.com>
Cc: bpf@...r.kernel.org, Alexei Starovoitov <ast@...nel.org>, Andrii
 Nakryiko <andrii@...nel.org>, Arthur Fabre <arthur@...hurfabre.com>, Daniel
 Borkmann <daniel@...earbox.net>, Eduard Zingerman <eddyz87@...il.com>, Eric
 Dumazet <edumazet@...gle.com>, Jesper Dangaard Brouer <hawk@...nel.org>,
 Jesse Brandeburg <jbrandeburg@...udflare.com>, Joanne Koong
 <joannelkoong@...il.com>, Lorenzo Bianconi <lorenzo@...nel.org>, Martin
 KaFai Lau <martin.lau@...ux.dev>, Toke Høiland-Jørgensen <thoiland@...hat.com>, Yan Zhai <yan@...udflare.com>,
 kernel-team@...udflare.com, netdev@...r.kernel.org, Stanislav Fomichev
 <sdf@...ichev.me>
Subject: Re: [PATCH bpf-next v4 2/8] bpf: Enable read/write access to skb
 metadata through a dynptr

On Fri, 25 Jul 2025 11:43:19 +0200 Jakub Sitnicki wrote:
> > Taking about the next step, once skb metadata is preserved past the TC
> > hook - here my impression from Netdev was that the least suprising thing
> > to do will be to copy-on-clone or copy-on-write (if we can pull it off).  
> 
> Now that Martin has enlightened me [1] how things work today for skb
> payload dynptr's, I will first try to follow the same approach, that is:
> 
> Make a copy of skb metadata before the BPF program runs, if the program
> may write to the metadata.

👍️

On the pskb_expand_head() behavior we should probably ask Daniel?
I suspect it's just to "fail closed". But as you said we can follow
up on that later, not a blocker in practice on Rx.