| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20260107-skb-meta-safeproof-netdevs-rx-only-v3-0-0d461c5e4764@cloudflare.com>
Date: Wed, 07 Jan 2026 15:28:00 +0100
From: Jakub Sitnicki <jakub@...udflare.com>
To: bpf@...r.kernel.org
Cc: netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>, Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Jesper Dangaard Brouer <hawk@...nel.org>,
John Fastabend <john.fastabend@...il.com>,
Stanislav Fomichev <sdf@...ichev.me>, Simon Horman <horms@...nel.org>,
Andrii Nakryiko <andrii@...nel.org>,
Martin KaFai Lau <martin.lau@...ux.dev>,
Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>,
Yonghong Song <yonghong.song@...ux.dev>, KP Singh <kpsingh@...nel.org>,
Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
kernel-team@...udflare.com
Subject: [PATCH bpf-next v3 00/17] Decouple skb metadata tracking from MAC
header offset
This series continues the effort to provide reliable access to xdp/skb
metadata from BPF context on the receive path. We have recently talked
about it at Plumbers [1].
Currently skb metadata location is tied to the MAC header offset:
[headroom][metadata][MAC hdr][L3 pkt]
^
skb_metadata_end = head + mac_header
This design breaks on L2 decapsulation (VLAN, GRE, etc.) when the MAC
offset is reset. The naive fix is to memmove metadata on every decap path,
but we can avoid this cost by tracking metadata position independently.
Introduce a dedicated meta_end field in skb_shared_info that records where
metadata ends relative to skb->head:
[headroom][metadata][gap][MAC hdr][L3 pkt]
^
skb_metadata_end = head + meta_end
This allows BPF dynptr access (bpf_dynptr_from_skb_meta()) to work without
memmove. For skb->data_meta pointer access, which expects metadata
immediately before skb->data, make the verifier inject realignment code in
TC BPF prologue.
Patches 1-9 enforce the calling convention: skb_metadata_set() must be
called after skb->data points past the metadata area, ensuring meta_end
captures the correct position. Patch 10 implements the core change.
Patches 11-14 extend the verifier to track data_meta usage, and patch 15
adds the realignment logic. Patch 16 adds selftests covering L2 decap
scenarios.
Note: This series does not address moving metadata on L2 encapsulation when
forwarding packets. VLAN and QinQ have already been patched when fixing TC
BPF helpers [2], but other tagging/tunnel code still requires changes.
Note to maintainers: This is not a typical series, in the sense that it
touches both the networking drivers and the BPF verifier. The driver
changes (patches 1-9) can be split out, if it makes patch wrangling easier.
Thanks,
-jkbs
[1] https://lpc.events/event/19/contributions/2269/
[2] https://lore.kernel.org/all/20251105-skb-meta-rx-path-v4-0-5ceb08a9b37b@cloudflare.com/
Signed-off-by: Jakub Sitnicki <jakub@...udflare.com>
---
Changes in v3:
- Use BPF_EMIT_CALL in gen_prologue (patch 15, 16) (Alexei)
(Will convert bpf_qdisc/testmod as a follow up.)
- Link to v2: https://lore.kernel.org/r/20260105-skb-meta-safeproof-netdevs-rx-only-v2-0-a21e679b5afa@cloudflare.com
Changes in v2:
- Add veth driver fix (patch 7)
- Add selftests for L2 decap paths (patch 16)
- Link to RFC: https://lore.kernel.org/r/20251124-skb-meta-safeproof-netdevs-rx-only-v1-0-8978f5054417@cloudflare.com
---
Jakub Sitnicki (17):
bnxt_en: Call skb_metadata_set when skb->data points at metadata end
i40e: Call skb_metadata_set when skb->data points at metadata end
igb: Call skb_metadata_set when skb->data points at metadata end
igc: Call skb_metadata_set when skb->data points at metadata end
ixgbe: Call skb_metadata_set when skb->data points at metadata end
net/mlx5e: Call skb_metadata_set when skb->data points at metadata end
veth: Call skb_metadata_set when skb->data points at metadata end
xsk: Call skb_metadata_set when skb->data points at metadata end
xdp: Call skb_metadata_set when skb->data points at metadata end
net: Track skb metadata end separately from MAC offset
bpf, verifier: Remove side effects from may_access_direct_pkt_data
bpf, verifier: Turn seen_direct_write flag into a bitmap
bpf, verifier: Propagate packet access flags to gen_prologue
bpf, verifier: Track when data_meta pointer is loaded
bpf, verifier: Support direct kernel calls in gen_prologue
bpf: Realign skb metadata for TC progs using data_meta
selftests/bpf: Test skb metadata access after L2 decapsulation
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +-
drivers/net/ethernet/intel/igb/igb_xsk.c | 2 +-
drivers/net/ethernet/intel/igc/igc_main.c | 4 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/en/xsk/rx.c | 2 +-
drivers/net/veth.c | 4 +-
include/linux/bpf.h | 2 +-
include/linux/bpf_verifier.h | 8 +-
include/linux/skbuff.h | 37 ++-
kernel/bpf/cgroup.c | 2 +-
kernel/bpf/verifier.c | 54 ++--
net/core/dev.c | 5 +-
net/core/filter.c | 62 ++++-
net/core/skbuff.c | 10 +-
net/core/xdp.c | 2 +-
net/sched/bpf_qdisc.c | 3 +-
tools/testing/selftests/bpf/config | 6 +-
.../bpf/prog_tests/xdp_context_test_run.c | 292 +++++++++++++++++++++
tools/testing/selftests/bpf/progs/test_xdp_meta.c | 48 ++--
.../testing/selftests/bpf/test_kmods/bpf_testmod.c | 6 +-
21 files changed, 466 insertions(+), 89 deletions(-)
Powered by blists - more mailing lists