Re: [PATCH bpf-next v2 00/11] bpf: Scope callback arguments to their frame

[Eduard Zingerman]

On Fri, 2026-10-09 at 13:27 -0700, Ihor Solodrai wrote:
> A callback-calling helper or kfunc can pass its callback a pointer
> that is only valid for the callback invocation, and the verifier has
> no way to express that lifetime.
> 
> Two helpers need fixing:
> 
>   * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a
>     sample it releases as soon as the callback returns. Saving this
>     pointer in callback_ctx leaves it pointing into reused kernel
>     stack and allows arbitrary kernel read and write (bpf-next only,
>     see patch #8).
> 
>   * bpf_for_each_map_elem() over an array or per-CPU array map passes
>     the address of a u32 held in bpf_for_each_array_elem()'s own frame,
>     leaking four bytes of kernel stack.
> 
> Both arguments point into a helper's own frame, with nothing
> longer-lived to anchor them to. Rejecting spills of the dynptr pointer
> alone would still allow derived slices and clones to escape.
> 
> Introduce REF_TYPE_FRAME for this use case: a reference owned by a
> callee frame, dropped when the frame is popped. Tie each argument to
> this reference so callback return invalidates it and its descendants.
> 
> Callback setters repeat register defaults and map metadata setup,
> while reference release couples descendant invalidation to object
> release. The refactoring patches give common initialization one owner
> and separate invalidation from reference removal. Frame lifetime
> tracking can then reuse the existing reference machinery.
> 
> ---
> 
> Patches #1-6 are non-functional preparation. Patch #7 introduces
> REF_TYPE_FRAME and its diagnostics; #8 and #10 apply it to the
> helpers, and #9 and #11 add selftests.
> 
> v1->v2:
>   * Add the refactoring patches: release frame references in one scan,
>     and fold diagnostics into the REF_TYPE_FRAME introduction
>   * Replace temporary argument mask and deferred register scan with
>     reference acquisition directly in the owning verifier state during
>     callback setup (Eduard)
>   * Reuse callback_park_dynptr() for the nested drain test
> 
> v1: https://lore.kernel.org/r/20260922010333.1226537-1-ihor.solodrai@xxxxxxxxx
> 
> ---

The series lgtm, but it needs a respin because bpf-next had moved.
Also, what Alexei suggests makes sense to me, it would be a bit simpler.
Ihor, please take whatever approach you think is reasonable and respin.
If you decide to respin as-is, feel free to add
"Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx>".