netdev - Re: [PATCH bpf-next v2 1/4] bpf, verifier: Support direct helper calls from prologue/epilogue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <874io9tonn.fsf@cloudflare.com>
Date: Sun, 25 Jan 2026 21:37:00 +0100
From: Jakub Sitnicki <jakub@...udflare.com>
To: Martin KaFai Lau <martin.lau@...ux.dev>
Cc: Alexei Starovoitov <ast@...nel.org>,  Daniel Borkmann
 <daniel@...earbox.net>,  John Fastabend <john.fastabend@...il.com>,
  Andrii Nakryiko <andrii@...nel.org>,  Eduard Zingerman
 <eddyz87@...il.com>,  Song Liu <song@...nel.org>,  Yonghong Song
 <yonghong.song@...ux.dev>,  KP Singh <kpsingh@...nel.org>,  Stanislav
 Fomichev <sdf@...ichev.me>,  Hao Luo <haoluo@...gle.com>,  Jiri Olsa
 <jolsa@...nel.org>,  Amery Hung <ameryhung@...il.com>,
  netdev@...r.kernel.org,  kernel-team@...udflare.com,
  ihor.solodrai@...ux.dev,  bpf@...r.kernel.org
Subject: Re: [PATCH bpf-next v2 1/4] bpf, verifier: Support direct helper
 calls from prologue/epilogue

On Fri, Jan 23, 2026 at 03:49 PM -08, Martin KaFai Lau wrote:
> On 1/23/26 9:05 AM, Jakub Sitnicki wrote:
>> @@ -23909,6 +23928,9 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
>>   			goto next_insn;
>>   		}
>>   patch_call_imm:
>> +		if (env->insn_aux_data[i + delta].finalized_call)
>> +			goto next_insn;
>> +
>>   		fn = env->ops->get_func_proto(insn->imm, env->prog);
>>   		/* all functions that have prototype and verifier allowed
>>   		 * programs to call them, must be real in-kernel functions
>> @@ -23920,6 +23942,7 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
>>   			return -EFAULT;
>>   		}
>>   		insn->imm = fn->func - __bpf_call_base;
>> +		env->insn_aux_data[i + delta].finalized_call = true;
>>   next_insn:
>>   		if (subprogs[cur_subprog + 1].start == i + delta + 1) {
>>   			subprogs[cur_subprog].stack_depth += stack_depth_extra;
>> diff --git a/net/core/filter.c b/net/core/filter.c
>> index d14401193b01..cb39388f69a9 100644
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -9082,8 +9082,7 @@ static int bpf_unclone_prologue(struct bpf_insn *insn_buf, bool direct_write,
>>   	/* ret = bpf_skb_pull_data(skb, 0); */
>>   	*insn++ = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
>>   	*insn++ = BPF_ALU64_REG(BPF_XOR, BPF_REG_2, BPF_REG_2);
>> -	*insn++ = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
>> -			       BPF_FUNC_skb_pull_data);
>> +	*insn++ = BPF_EMIT_CALL(bpf_skb_pull_data);
>
> Ihor reported that the test_map has started failing on arm64.
>
> https://github.com/kernel-patches/bpf/actions/runs/21298510237/job/61311053284
> https://github.com/kernel-patches/bpf/actions/runs/21298505282/job/61312363930
> https://github.com/kernel-patches/bpf/actions/runs/21301695907/job/61321375157
>
> For BPF_PROG_TYPE_SK_SKB, the BPF_FUNC_skb_pull_data has a different
> func_proto. It is sk_skb_pull_data instead of bpf_skb_pull_data.
> A different func needs to be emitted here based on prog type.
> Not sure why it only fails on arm64.
>
> The set has been reverted to get the CI going.
> Please address the issue, add a test for this case, and
> then respin. Thanks.

Sorry for this oversight.

I see now that sk_skb_pull_data doesn't bpf_compute_data_pointers which
writes over skb->cb. Perhaps that has something to do with the failure.

Will get this sorted.

Expect some delay. This is a pre-conferece week (FOSDEM).