[PATCH bpf-next v2 00/11] bpf: Scope callback arguments to their frame

[Ihor Solodrai]

A callback-calling helper or kfunc can pass its callback a pointer
that is only valid for the callback invocation, and the verifier has
no way to express that lifetime.

Two helpers need fixing:

  * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a
    sample it releases as soon as the callback returns. Saving this
    pointer in callback_ctx leaves it pointing into reused kernel
    stack and allows arbitrary kernel read and write (bpf-next only,
    see patch #8).

  * bpf_for_each_map_elem() over an array or per-CPU array map passes
    the address of a u32 held in bpf_for_each_array_elem()'s own frame,
    leaking four bytes of kernel stack.

Both arguments point into a helper's own frame, with nothing
longer-lived to anchor them to. Rejecting spills of the dynptr pointer
alone would still allow derived slices and clones to escape.

Introduce REF_TYPE_FRAME for this use case: a reference owned by a
callee frame, dropped when the frame is popped. Tie each argument to
this reference so callback return invalidates it and its descendants.

Callback setters repeat register defaults and map metadata setup,
while reference release couples descendant invalidation to object
release. The refactoring patches give common initialization one owner
and separate invalidation from reference removal. Frame lifetime
tracking can then reuse the existing reference machinery.

---

Patches #1-6 are non-functional preparation. Patch #7 introduces
REF_TYPE_FRAME and its diagnostics; #8 and #10 apply it to the
helpers, and #9 and #11 add selftests.

v1->v2:
  * Add the refactoring patches: release frame references in one scan,
    and fold diagnostics into the REF_TYPE_FRAME introduction
  * Replace temporary argument mask and deferred register scan with
    reference acquisition directly in the owning verifier state during
    callback setup (Eduard)
  * Reuse callback_park_dynptr() for the nested drain test

v1: https://lore.kernel.org/r/20260922010333.1226537-1-ihor.solodrai@xxxxxxxxx

---

Ihor Solodrai (11):
  bpf: Set up callee state outside of setup_func_entry()
  bpf: Pass the owning verifier state to callback setters
  bpf: Append complete reference states
  bpf: Separate reference removal from descendant invalidation
  bpf: Share map-backed callback register setup
  bpf: Rely on callback frame initialization defaults
  bpf: Introduce REF_TYPE_FRAME in the verifier
  bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame
  selftests/bpf: Cover the user ringbuf callback dynptr lifetime
  bpf: Scope the bpf_for_each_map_elem() array key to the callback frame
  selftests/bpf: Cover callback-frame map key lifetime

 include/linux/bpf.h                           |   5 +
 include/linux/bpf_verifier.h                  |   6 +-
 kernel/bpf/arraymap.c                         |  18 +-
 kernel/bpf/diagnostics.c                      |   3 +
 kernel/bpf/diagnostics.h                      |   1 +
 kernel/bpf/states.c                           |   4 +
 kernel/bpf/verifier.c                         | 392 +++++++++---------
 .../selftests/bpf/progs/exceptions_fail.c     |  20 +
 .../selftests/bpf/progs/user_ringbuf_fail.c   | 135 ++++++
 .../bpf/progs/verifier_iterating_callbacks.c  |  91 ++++
 10 files changed, 476 insertions(+), 199 deletions(-)


base-commit: e1d84a37cba984388988d2f1ddc84561413f0db2
-- 
2.56.0