netdev - Re: [PATCH bpf-next 2/2] selftests/bpf: Test changing packet data from global functions with a kfunc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a79618-cd71-4f4f-ad65-b492e571ade5@linux.dev>
Date: Thu, 25 Sep 2025 14:58:16 -0700
From: Martin KaFai Lau <martin.lau@...ux.dev>
To: Amery Hung <ameryhung@...il.com>
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org,
 alexei.starovoitov@...il.com, andrii@...nel.org, daniel@...earbox.net,
 martin.lau@...nel.org, kernel-team@...a.com
Subject: Re: [PATCH bpf-next 2/2] selftests/bpf: Test changing packet data
 from global functions with a kfunc

On 9/25/25 10:00 AM, Amery Hung wrote:
> The verifier should invalidate all packet pointers after a packet data
> changing kfunc is called. So, similar to commit 3f23ee5590d9
> ("selftests/bpf: test for changing packet data from global functions"),
> test changing packet data from global functions to make sure packet
> pointers are indeed invalidated.

Applied. Thanks.

> +__noinline
> +long xdp_pull_data2(struct xdp_md *x, __u32 len)
> +{
> +	return bpf_xdp_pull_data(x, len);

This tested the mark_subprog_changes_pkt_data() in visit_insn().

afaik, it does not test the clear_all_pkt_pointers() in check_"k"func_call(). 
Unlike the existing "changes_data" helpers, it is the first kfunc doing it. 
Although we know that it should work after fixing the xdp_native.bpf.c :), it is 
still good to have a regression test for it. Probably another xdp prog in 
verifier_sock.c that does bpf_xdp_pull_data() in the main prog. Please follow up.


> +}
> +
> +__noinline
> +long xdp_pull_data1(struct xdp_md *x, __u32 len)
> +{
> +	return xdp_pull_data2(x, len);
> +}
> +
> +/* global function calls bpf_xdp_pull_data(), which invalidates packet
> + * pointers established before global function call.
> + */
> +SEC("xdp")
> +__failure __msg("invalid mem access")
> +int invalidate_xdp_pkt_pointers_from_global_func(struct xdp_md *x)
> +{
> +	int *p = (void *)(long)x->data;
> +
> +	if ((void *)(p + 1) > (void *)(long)x->data_end)
> +		return TCX_DROP;
> +	xdp_pull_data1(x, 0);
> +	*p = 42; /* this is unsafe */
> +	return TCX_PASS;

I fixed this to XDP_PASS as we discussed offline.

> +}
> +
>   __noinline
>   int tail_call(struct __sk_buff *sk)
>   {