[PATCH bpf v2 0/3] libbpf: Validate struct_ops member offsets

[Mingpei CAO <caomingpei@gmail.com>]

A local struct_ops type can contain a bitfield absent from the
corresponding kernel BTF type. libbpf checks whether data for an absent
local member is zero.

For a bitfield, member->offset contains the bit position and field width.
bpf_map__init_kern_struct_ops() used the full value to create a data
pointer before checking the member range. libbpf_is_mem_zeroed() could
then read outside the local struct_ops data.
ASan reported a SEGV. bpf_map__init_kern_struct_ops() also failed to check
offsets for non-bitfield members.

Patch 1 rejects local and kernel bitfields before reading member data.
Patch 1 also checks every local and kernel member range before creating a
data pointer.

Patch 2 represents unsupported bitfield storage as padding in generated
skeletons. The padding preserves the struct_ops map and keeps supported
fields at their declared BTF offsets.

Patch 3 checks the bitfield rejection, the generated C structure, and an
out-of-range non-bitfield member.

AI assistance was used in preparing this series. I independently reviewed
the changes and reproduced the issue and fix.

Changes since v1:
- name the local member and the matching kernel BTF type;
- remove JIT, compiler, and initialization details from the problem summary;
- check every offset used to create a data pointer;
- represent unsupported bitfield storage as padding while preserving the
  struct_ops map and supported field offsets;
- test adjacent bitfield members and an out-of-range non-bitfield member.

Link: https://lore.kernel.org/bpf/20260910172340.1467764-1-caomingpei@gmail.com/

Mingpei CAO (3):
  libbpf: Validate struct_ops member offsets before data access
  bpftool: Keep struct_ops field offsets when skipping bitfields
  selftests/bpf: Cover struct_ops bitfield and offset validation

 tools/bpf/bpftool/gen.c                       | 147 ++++++++++++------
 tools/lib/bpf/libbpf.c                        |  80 ++++++++--
 .../bpf/prog_tests/test_struct_ops_module.c   |  91 ++++++++++-
 .../selftests/bpf/progs/struct_ops_module.c   |  17 ++
 4 files changed, 272 insertions(+), 63 deletions(-)

base-commit: 7d70a0b02d262971201fdd1e221586bdd95c2910
-- 
2.43.0