Re: [PATCH bpf-next v1 2/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame

[bot+bpf-ci]

> bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame
>
> bpf_user_ringbuf_drain() peeks a sample, initialises a struct
> bpf_dynptr_kern on its own stack, passes it to the callback, and calls
> __bpf_user_ringbuf_sample_release() as soon as the callback returns.
> Neither the descriptor nor the sample it describes is valid afterwards.
> set_user_ringbuf_callback_state() only gives the callback's R1 a type.
> The callback can therefore store the CONST_PTR_TO_DYNPTR register into
> callback_ctx, which points into a frame that outlives the call, and the
> program can use it after the drain returns. Three routes reach past the
> callback:
>   - the register itself, spillable since v7.3-rc1, which points at a
>     descriptor on reused kernel stack and gives the program an arbitrary
>     kernel read/write
>   - a bpf_dynptr_data() or bpf_dynptr_slice() result, which carries
>     the dynptr's id as its parent_id
>   - a bpf_dynptr_clone(), which is a by-value copy in the caller's
>     frame and can be sliced after the drain returns
> Declare R1 frame-scoped so all three are invalidated when the callback
> frame is popped.
> Reported-by: Nicholas Carlini <npc@xxxxxxxxxxxxx>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@xxxxxxxxx>

This isn't a bug, but should this include a Fixes: tag? The commit fixes a
security vulnerability (arbitrary kernel read/write via use-after-free).

  Fixes: 205715673844 ("bpf: Add bpf_user_ringbuf_drain() helper")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/35674974944