On 7/24/25 4:53 AM, Jakub Sitnicki wrote:
In this series we maintain the status quo. Access metadata dynptr is limited to TC BPF hook only, so we provide the same guarntees as the existing __sk_buff->data_meta.
The verifier tracks if the __sk_buff->data_meta is written in "seen_direct_write". tc_cls_act_prologue is called and that should have triggered skb_metadata_clear for a clone skb. Meaning, for a clone skb, I think __sk_buff->data_meta is read-only.
bpf_dynptr_from_skb_meta can set the DYNPTR_RDONLY_BIT if the skb is a clone.
