diff options
| author | Josef Bacik <josef@toxicpanda.com> | 2026-10-17 23:09:47 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-18 00:36:43 +0000 |
| commit | 1c19f2b3b2f3b55c8017092257634cb8229b7d97 (patch) | |
| tree | 3a31d5dbe53ba579dd999cbd425389a86d78f7cc /tools/perf/scripts/python/bin/stackcollapse-report | |
| parent | bb72c2866831b571249929714d118ccea1ecb747 (diff) | |
bpf: Follow the head if an skb is written from a slice
The source of bpf_dynptr_write() may be a slice of the skb which is
written to, that is a pointer into its head. bpf_dynptr_copy() does it by
itself for a copy inside of one skb, if the source is linear and the
destination is not.
__bpf_skb_store_bytes() and __bpf_skb_meta_store_bytes() make the skb
writable first. If that reallocates the head, the source points to the old
one, and freed memory is copied into the packet.
The offsets in the head do not change when it is reallocated here. Move
the source along with the head.
Fixes: 2012c867c800 ("bpf: verifier: Accept dynptr mem as mem in helpers")
Fixes: f38499ff45f5 ("bpf: Unclone skb head on bpf_dynptr_write to skb metadata")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017230950.802052-14-alexei.starovoitov@gmail.com
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-report')
0 files changed, 0 insertions, 0 deletions