From: Alexei Starovoitov Date: Fri, 26 Jun 2026 00:51:20 +0000 (-0700) Subject: Merge branch 'bpf-reject-offset-refcount-acquire-arguments' X-Git-Tag: v7.2-rc2~20^2~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fbc10dff7846206585b02864fef4ebfd7cadf6e2;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'bpf-reject-offset-refcount-acquire-arguments' Yiyang Chen says: ==================== bpf: Reject offset refcount acquire arguments bpf_refcount_acquire() is modeled as returning a refcounted allocation base, but it currently accepts PTR_TO_BTF_ID | MEM_ALLOC arguments whose offset already points at an embedded graph node returned from a list or rbtree operation. At runtime the kfunc starts from the supplied pointer and adds the type's refcount offset. With a graph-node pointer, that starts from base + node_off, while the verifier treats the returned pointer as the allocation base. Reject non-zero fixed-offset arguments to keep the runtime operation and the verifier model aligned. Programs that pop graph nodes can still acquire a reference after normalizing the node pointer with container_of(). Patch 1 handles the zero fixed-offset requirement in the existing check_func_arg_reg_off() / __check_ptr_off_reg() path without consuming a bpf_type_flag bit. Patch 2 adds a rejected direct list-node case. Changes from v3: - Add Eduard's Acked-by to patch 1. - Drop the redundant rbtree selftest case; the list case exercises the same refcount-acquire fixed-offset rejection path. - Trim the selftest commit message and remove the selftest Fixes tag. Changes from v2: - Avoid adding a new bpf_type_flag bit. - Carry the refcount-acquire zero fixed-offset requirement with an internal check_func_arg_reg_off() parameter. Changes from v1: - Move zero fixed-offset enforcement into check_func_arg_reg_off() / __check_ptr_off_reg(), as suggested by Eduard. - Drop the positive container_of() selftest case. - Remove the stale bpf_obj_drop() after bpf_list_push_front(), since the pushed reference is consumed even when the verifier explores the error branch. - Rebase to bpf-next master a975094bf98c. v3: https://lore.kernel.org/bpf/cover.1781979133.git.chenyy23@mails.tsinghua.edu.cn/ v2: https://lore.kernel.org/bpf/cover.1781963957.git.chenyy23@mails.tsinghua.edu.cn/ v1: https://lore.kernel.org/bpf/cover.1781852308.git.chenyy23@mails.tsinghua.edu.cn/ ==================== Link: https://patch.msgid.link/cover.1782192383.git.chenyy23@mails.tsinghua.edu.cn Signed-off-by: Alexei Starovoitov --- fbc10dff7846206585b02864fef4ebfd7cadf6e2