Re: [PATCH bpf v1 0/4] bpf: Scope callback arguments to their frame

[Kumar Kartikeya Dwivedi]

On Sat, 7 Nov 2026 at 00:15, Ihor Solodrai <ihor.solodrai@xxxxxxxxx> wrote:
>
> On 11/6/26 4:11 PM, Ihor Solodrai wrote:
> > A callback-calling helper can pass its callback a pointer that is only
> > valid for the callback invocation, and the verifier has no way to
> > express that lifetime.
> >
> > Two helpers need fixing:
> >
> >   * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a
> >     sample it releases as soon as the callback returns. Saving this
> >     pointer in callback_ctx leaves it pointing into reused kernel
> >     stack and allows arbitrary kernel read and write since v7.3.
> >
> >   * bpf_for_each_map_elem() over an array or per-CPU array map passes
> >     the address of a u32 held in bpf_for_each_array_elem()'s own frame,
> >     leaking four bytes of kernel stack.
> >
> > Give the callback frame an id and make it both the id and the
> > parent_id of such an argument, so that slices and clones descend from
> > it. Invalidate the id and its descendants when the frame is popped.
> >
> > ---
> >
> > v2->v3:
>
> Sorry, I forgot -v3 when doing git format-patch
>
> Should I resend, or is this fine?
>

Should be ok, can be ascertained from the cover letter.

> > [...]