[PATCH RFC bpf-next 14/15] bpf, verifier: Track when data_meta pointer is loaded
From: Jakub Sitnicki <jakub@cloudflare.com>
Date: 2025-11-24 16:29:29
Also in:
bpf
Subsystem:
bpf [core], bpf [general] (safe dynamic programs and tools), the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, Linus Torvalds
Introduce PA_F_DATA_META_LOAD flag to track when a BPF program loads the skb->data_meta pointer. This information will be used by gen_prologue() to handle cases where there is a gap between metadata end and skb->data, requiring metadata to be realigned. Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> --- include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 4 ++++ 2 files changed, 5 insertions(+)
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 42ce94ce96ba..fa330e4dc14a 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h@@ -639,6 +639,7 @@ enum priv_stack_mode { enum packet_access_flags { PA_F_DIRECT_WRITE = BIT(0), + PA_F_DATA_META_LOAD = BIT(1), }; struct bpf_subprog_info {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index bb4e70913ab4..32989e29a5e1 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c@@ -6160,6 +6160,10 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, } else { env->insn_aux_data[insn_idx].ctx_field_size = info->ctx_field_size; } + + if (base_type(info->reg_type) == PTR_TO_PACKET_META) + env->seen_packet_access |= PA_F_DATA_META_LOAD; + /* remember the offset of last byte accessed in ctx */ if (env->prog->aux->max_ctx_offset < off + size) env->prog->aux->max_ctx_offset = off + size;
--
2.43.0