netdev - Re: [PATCH bpf-next 2/2] selftests/bpf: Test changing packet data from global functions with a kfunc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMB2axNBzcShfP6ENKqRW_PiruCKA=keH9oDQBgNEzWFLN-7eg@mail.gmail.com>
Date: Thu, 25 Sep 2025 16:16:25 -0700
From: Amery Hung <ameryhung@...il.com>
To: Martin KaFai Lau <martin.lau@...ux.dev>
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org, alexei.starovoitov@...il.com, 
	andrii@...nel.org, daniel@...earbox.net, martin.lau@...nel.org, 
	kernel-team@...a.com
Subject: Re: [PATCH bpf-next 2/2] selftests/bpf: Test changing packet data
 from global functions with a kfunc

On Thu, Sep 25, 2025 at 2:58 PM Martin KaFai Lau <martin.lau@...ux.dev> wrote:
>
> On 9/25/25 10:00 AM, Amery Hung wrote:
> > The verifier should invalidate all packet pointers after a packet data
> > changing kfunc is called. So, similar to commit 3f23ee5590d9
> > ("selftests/bpf: test for changing packet data from global functions"),
> > test changing packet data from global functions to make sure packet
> > pointers are indeed invalidated.
>
> Applied. Thanks.
>
> > +__noinline
> > +long xdp_pull_data2(struct xdp_md *x, __u32 len)
> > +{
> > +     return bpf_xdp_pull_data(x, len);
>
> This tested the mark_subprog_changes_pkt_data() in visit_insn().
>
> afaik, it does not test the clear_all_pkt_pointers() in check_"k"func_call().
> Unlike the existing "changes_data" helpers, it is the first kfunc doing it.
> Although we know that it should work after fixing the xdp_native.bpf.c :), it is
> still good to have a regression test for it. Probably another xdp prog in
> verifier_sock.c that does bpf_xdp_pull_data() in the main prog. Please follow up.
>

I will add another test in verifier_sock.c.

>
> > +}
> > +
> > +__noinline
> > +long xdp_pull_data1(struct xdp_md *x, __u32 len)
> > +{
> > +     return xdp_pull_data2(x, len);
> > +}
> > +
> > +/* global function calls bpf_xdp_pull_data(), which invalidates packet
> > + * pointers established before global function call.
> > + */
> > +SEC("xdp")
> > +__failure __msg("invalid mem access")
> > +int invalidate_xdp_pkt_pointers_from_global_func(struct xdp_md *x)
> > +{
> > +     int *p = (void *)(long)x->data;
> > +
> > +     if ((void *)(p + 1) > (void *)(long)x->data_end)
> > +             return TCX_DROP;
> > +     xdp_pull_data1(x, 0);
> > +     *p = 42; /* this is unsafe */
> > +     return TCX_PASS;
>
> I fixed this to XDP_PASS as we discussed offline.
>

Thank you!

> > +}
> > +
> >   __noinline
> >   int tail_call(struct __sk_buff *sk)
> >   {
>