From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97C51397688 for ; Wed, 24 Jun 2026 07:20:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782285664; cv=none; b=oFMuo5X88NPfjKnb7zuPeoyEREhFcpOweni9ApQPCLsg1aH7J/JMqbEePAxklPP+7d4iey1u5SMKI6fovoEirzRkfs51LtLvV2IvUMlq8AasIV/d+tnGMPOrmKY2aEwuTBFxTPHl5RXiJ+bT9CBZJc8+w0/qV5nLSceuT8gOeBI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782285664; c=relaxed/simple; bh=pVd11EH3T/mNIRJabrh1Cdzac8ikx4GAtiYQD2B61tM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TxFsf55CW2uPKyLUadLV3kYF4qfNvVaLnXZ9BxwbH57gBO3Aakli4H2XxI+1qbePzeUBu1XMBzFPgb726zfvbMNKI5ri+8DK8/NpcYRPaPLXVk2vKSWqfGDtgktxILOhEGQqKi1LEizZ9NIui54yMDGS+m1Y+zACj5BdmVQUWK0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dbSXct2G; arc=none smtp.client-ip=209.85.210.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dbSXct2G" Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-8422871b42dso468139b3a.3 for ; Wed, 24 Jun 2026 00:20:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782285654; x=1782890454; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ZgCohTv+MX28dL9XB70gpLT76ubfXGom7LP2yheQ7Is=; b=dbSXct2GkyWFYmc9JJdArBbvNkGvtnlDdrTECP2rkYhcHrfjM7wNyAOpLYXhxpwf88 07zVv6C4qoMoKFDA+fXQcB9vCNAQNSd3opZ679Iho9Bc61vSGSFVMmZlkPDzYjRhn/2I wbYrwiVJ7hLSCu05oGa57+7ju+hvrH2HXANOHuQUECzZcS30BdHEW/8x1Wr+6lck/tXu rARkykTMnODykxd/XCvlBcQ9XVykASIVzMBKF5gWgGPRpm0wiVrySkpRzjqplpCJ8tKn /rvT8+v5B0TMWDYadGD1vCPUdoIa4iZYZIkJHz8eRCHnbGTmxkoN6lkRydkMdO7sSHn5 t3gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782285654; x=1782890454; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ZgCohTv+MX28dL9XB70gpLT76ubfXGom7LP2yheQ7Is=; b=EF8jY9CDMwa7jWUwGzZhz2U+V8Db1l9YwlVPuZc/dcAozpkXLlwMzDqBsRTi0pQLri w+eVvOvaTrsSou3+/S7hnrMqXfAmWWpA8vCXRaUlieGSjYYXbXVe+Vvo15dmh8n42jm6 zBSKdESNhJm2ruuNbhed6fgpMYW7vUwQ2CkV4xq8BaLxwUG8x7buEuggkdO2Lv24i97w zs7798D7ld3VBc3nZptTwkBauCmbrtlNocIm9bfXvRIlIfmUNUkUchI4sONaBc45XNMQ Dq6j4Ccn3TxM8YCUpTDV6DskdOkS3Z7zXq8mWnwhJcuP7nm1qOnW16nsqgjd5PmEPp1I 7hRA== X-Forwarded-Encrypted: i=1; AFNElJ9m4PHmaN2FsiA3woRZEcn82hz5lJq9hkKZxi02cS9pdJD2OVtkFJH2MSsfC6Ejuu9CsdbiO8E/2tO8y/c=@vger.kernel.org X-Gm-Message-State: AOJu0YxGJcejpSAbqYlyDSwwlmSOxKzsPp694Tl7dvtrvI2ZBhQ/TDPx M1tOxnKWjCGwm8pa5+7OuJbwvcVv/82BKLQnJ6tk3fUkzokPnwnBxs9DbdYC72XFk/rGUg== X-Gm-Gg: AfdE7clpBtxEBHgdVcE20AQG3r/Os5cZv1CIplFgISUgpCne1yC2ITSDeNvTBDKQQ0/ 30ZzphwyprvZEuDKNejunzJ/HEf17L4IJaXWtNr8/enZkLrgHQHNyn3X2SvSUSy4Wxxv7b0Oqrx r9Ya8VdBOaxtXsVi90JCYfNOS3TJHyXYV6DFT/P79tq87edVpciS6E42DJg3m6518bA+mUmBTiY W7d6rlpstYxgecDNj+PX9R4r0P4T7VHkuNuARBpglabVcG1iBLEIUELFomzLcyBJXW/CmA2HL/L 9u2hk5vmM7ezXy8VKFBVhFo30NOqeA/HFwe5CDvOzpqgYgP/dpGKWRkk4nx1yWgBI5xgE/C1c3T H8AZs962QvH8ES9A/+6jWA9Zs2Jz5NxXRNQViknlmtI0wYWsMQyOW7VLK8wQXeyx54rs8GivZxD GuNQSG3Sh3gGEbHCzYnIdLpiJWfIDlzfWkHaddaLGmX9LsHLjDeysUmquHoTHLLuRg1hJwri40k wt9hRNI/bXbScizOvds7lyE9fU= X-Received: by 2002:a05:6a00:1804:b0:837:e9cc:d474 with SMTP id d2e1a72fcca58-845952107c4mr7570210b3a.2.1782285654414; Wed, 24 Jun 2026 00:20:54 -0700 (PDT) Received: from u2404-VMware-Virtual-Platform.localdomain ([202.8.105.120]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-845a413c7ecsm1498555b3a.56.2026.06.24.00.20.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Jun 2026 00:20:53 -0700 (PDT) From: Sun Jian To: bpf@vger.kernel.org Cc: sun.jian.kdev@gmail.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, andrii@kernel.org, martin.lau@linux.dev, eddyz87@gmail.com, memxor@gmail.com, song@kernel.org, yonghong.song@linux.dev, jolsa@kernel.org, shuah@kernel.org, dxu@dxuuu.xyz Subject: [PATCH bpf 1/2] bpf: Avoid eliding lookup NULLness for inner map templates Date: Wed, 24 Jun 2026 15:20:30 +0800 Message-ID: <20260624072031.735846-1-sun.jian.kdev@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Commit d2102f2f5d75 ("bpf: verifier: Support eliding map lookup nullness") allowed the verifier to elide NULLness of bpf_map_lookup_elem() for array maps when the key is statically known to be within max_entries. This is not valid for array maps used as inner map templates. For such maps, the template's max_entries is not necessarily the same as the max_entries of the concrete inner map used at runtime. As a result, a key that is within the template's max_entries can still be out of range for the concrete inner map, and the lookup may return NULL. Do not elide lookup NULLness for array maps used as inner map templates. Fixes: d2102f2f5d75 ("bpf: verifier: Support eliding map lookup nullness") Signed-off-by: Sun Jian --- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 7fb88e1cd7c4..3f38f85c3cb8 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -10590,6 +10590,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn if (func_id == BPF_FUNC_map_lookup_elem && can_elide_value_nullness(meta.map.ptr->map_type) && + !(meta.map.ptr->map_flags & BPF_F_INNER_MAP) && meta.const_map_key >= 0 && meta.const_map_key < meta.map.ptr->max_entries) ret_flag &= ~PTR_MAYBE_NULL; -- 2.43.0