Re: [PATCH v2 bpf-next 1/2] bpf: Reject bpf_skb_output() from return-side tracing

[Kumar Kartikeya Dwivedi]

On Tue Sep 22, 2026 at 3:54 AM CEST, Feng Yang wrote:
> From: Feng Yang <yangfeng@xxxxxxxxxx>
>
> BPF fexit programs run after the traced function returns, while their
> context still contains the original function argument values. A traced
> function is free to consume an skb argument before returning, so the
> pointer seen by fexit can already be stale.
>
> The verifier checks that the first argument to bpf_skb_output() has the
> BTF type of struct sk_buff, but that does not establish its lifetime.
> bpf_skb_event_output() then dereferences skb->len and can trigger a
> use-after-free.
>
> Do not expose bpf_skb_output() to tracing programs which can run after
> the target: fexit, fexit.multi, fsession and fsession.multi. Keep it
> available to fentry and other tracing attach types where it is already
> supported. fsession must be rejected because the same program runs on
> both entry and return and the verifier cannot prove that a helper call
> is entry-only.
>
> Fixes: fec56f5890d9 ("bpf: Introduce BPF trampoline")
> Reported-by: Quan Sun <2022090917019@xxxxxxxxxxxxxxxx>
> Reported-by: Yinhao Hu <dddddd@xxxxxxxxxxx>
> Reported-by: Kaiyan Mei <M202472210@xxxxxxxxxxx>
> Closes: https://lore.kernel.org/all/9d61b891-2d52-42b9-bc1a-ad963ccb675d@xxxxxxxxxxxxxxxx/
> Signed-off-by: Yun Lu <luyun@xxxxxxxxxx>
> Signed-off-by: Feng Yang <yangfeng@xxxxxxxxxx>
> ---

Sorry, this is not an acceptable fix. This negates usage of the function in all
fexit and fession attach points. Unless there is a simpler way to enumerate in
which attach points this helper should be disabled, it might not be worth doing
and leaving this be as is.

pw-bot: cr

> [...]