[PATCH bpf 0/2] libbpf: Reject private struct_ops bitfields before data access

[Mingpei CAO <caomingpei@gmail.com>]

This series fixes a bug in bpf_map__init_kern_struct_ops() that can
cause a userspace crash when loading a BPF object containing an all-zero
private bitfield in a local struct_ops mirror.

For structures with kind_flag set, member->offset also encodes the
bitfield width. bpf_map__init_kern_struct_ops() currently uses that raw
value to calculate the member data pointer before rejecting bitfields.
The absent-member compatibility path can consequently pass a pointer
far outside the struct_ops data to libbpf_is_mem_zeroed().

Patch 1 rejects local bitfields before calculating the data pointer.
Patch 2 adds a regression test for the all-zero private bitfield while
retaining the existing ordinary all-zero field compatibility control.

The issue was reproduced with a Clang generated object. Before the fix,
AddressSanitizer reported a SEGV caused by a read. After the fix, the
same object was rejected with -ENOTSUP and the expected bitfield
diagnostic. The ordinary all-zero field control continued to load
successfully.

AI assistance was used in preparing this series. I independently
reviewed the changes and reproduced the results.

Mingpei CAO (2):
  libbpf: Reject struct_ops bitfields before accessing data
  selftests/bpf: Test private struct_ops bitfield rejection

 tools/lib/bpf/libbpf.c                        |  9 ++++--
 .../bpf/prog_tests/test_struct_ops_module.c   | 31 +++++++++++++++++++
 .../selftests/bpf/progs/struct_ops_module.c   |  7 +++++
 3 files changed, 45 insertions(+), 2 deletions(-)


base-commit: e4a62833adff6ef0fe7c0b90393204fe3c26b5c5
-- 
2.43.0