Re: [PATCH bpf v1 0/4] bpf: Scope callback arguments to their frame

[Ihor Solodrai]

On 11/6/26 4:11 PM, Ihor Solodrai wrote:
> A callback-calling helper can pass its callback a pointer that is only
> valid for the callback invocation, and the verifier has no way to
> express that lifetime.
> 
> Two helpers need fixing:
> 
>   * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a
>     sample it releases as soon as the callback returns. Saving this
>     pointer in callback_ctx leaves it pointing into reused kernel
>     stack and allows arbitrary kernel read and write since v7.3.
> 
>   * bpf_for_each_map_elem() over an array or per-CPU array map passes
>     the address of a u32 held in bpf_for_each_array_elem()'s own frame,
>     leaking four bytes of kernel stack.
> 
> Give the callback frame an id and make it both the id and the
> parent_id of such an argument, so that slices and clones descend from
> it. Invalidate the id and its descendants when the frame is popped.
> 
> ---
> 
> v2->v3:

Sorry, I forgot -v3 when doing git format-patch

Should I resend, or is this fine?

> [...]