netdev - Re: [PATCH bpf-next v4 2/8] bpf: Enable read/write access to skb metadata through a dynptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87frekwqq0.fsf@cloudflare.com>
Date: Fri, 25 Jul 2025 11:43:19 +0200
From: Jakub Sitnicki <jakub@...udflare.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: bpf@...r.kernel.org,  Alexei Starovoitov <ast@...nel.org>,  Andrii
 Nakryiko <andrii@...nel.org>,  Arthur Fabre <arthur@...hurfabre.com>,
  Daniel Borkmann <daniel@...earbox.net>,  Eduard Zingerman
 <eddyz87@...il.com>,  Eric Dumazet <edumazet@...gle.com>,  Jesper Dangaard
 Brouer <hawk@...nel.org>,  Jesse Brandeburg <jbrandeburg@...udflare.com>,
  Joanne Koong <joannelkoong@...il.com>,  Lorenzo Bianconi
 <lorenzo@...nel.org>,  Martin KaFai Lau <martin.lau@...ux.dev>,  Toke
 Høiland-Jørgensen <thoiland@...hat.com>,  Yan Zhai
 <yan@...udflare.com>,
  kernel-team@...udflare.com,  netdev@...r.kernel.org,  Stanislav Fomichev
 <sdf@...ichev.me>
Subject: Re: [PATCH bpf-next v4 2/8] bpf: Enable read/write access to skb
 metadata through a dynptr

On Thu, Jul 24, 2025 at 01:53 PM +02, Jakub Sitnicki wrote:
> On Wed, Jul 23, 2025 at 05:30 PM -07, Jakub Kicinski wrote:
>> On Wed, 23 Jul 2025 19:36:47 +0200 Jakub Sitnicki wrote:
>>> Now that we can create a dynptr to skb metadata, make reads to the metadata
>>> area possible with bpf_dynptr_read() or through a bpf_dynptr_slice(), and
>>> make writes to the metadata area possible with bpf_dynptr_write() or
>>> through a bpf_dynptr_slice_rdwr().
>>
>> What are the expectations around the writes? Presumably we could have
>> two programs writing into the same metadata if the SKB is a clone, no?

[...]

> Taking about the next step, once skb metadata is preserved past the TC
> hook - here my impression from Netdev was that the least suprising thing
> to do will be to copy-on-clone or copy-on-write (if we can pull it off).

Now that Martin has enlightened me [1] how things work today for skb
payload dynptr's, I will first try to follow the same approach, that is:

Make a copy of skb metadata before the BPF program runs, if the program
may write to the metadata.

[1] https://lore.kernel.org/all/0190e181-c592-454a-a99b-5ec361ce84e9@linux.dev/