From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-149.mta0.migadu.com [91.218.175.149]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F17F483BEA for ; Sat, 17 Oct 2026 14:38:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.149 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792247921; cv=none; b=rcRPrf1iIzOOpq59bZZ1POuVOiE2jOcX5OMEIoEfySt+HieporSVZztq6l6+/E1tvLJyaGOKSItx5OI7Dht2O7MyWCSSkTMdtl1rzNQbRxiVpmh6kNsJr/MFBLNNeY9mAIzl39zH1Wqarj7NRR09JZxArngkDNLn9F+dHku15eA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792247921; c=relaxed/simple; bh=EpvuBxKqKA4laIc2RRTTydYfpNhHi/D1qOfWR0z9OUo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iDRJKmDETVItCZlN6Y25uagVAn5+yvZXwJO+p61O4dOzHmi7BvOA1lJ3m5wk7tY30eipqHIuDDAVFGXrZquyHm1pQjN7QyyD1Z3S7O0UFjg2czYDRdm9fS6dnhylO5+zeeut/iR4VZLQZmy0VBYxPS7Lm9AgIgFdro0Wa9a/wgM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=r2PVeqrA; arc=none smtp.client-ip=91.218.175.149 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="r2PVeqrA" X-Envelope-To: bpf@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=EpvuBxKqKA4laIc2RRTTydYfpNhHi/D1qOfWR0z9OUo=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1792247917; v=1; x=1792852717; b=r2PVeqrAiC5wbllLK5NICeltOPFNm5MiLAbadfwdbAPomRLlMlkvthAcfOBxZYbtN35eeovR J1ejVWAPclZvudLgvJMpcRMkkZBqYqS192s6ucHdWXfYa4fTFKaMy3RIekHpPvKiEeZnLBbxEuW 29aVYBFdmOicLpUSo/e5/6Dk= X-Envelope-To: bpf@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 826e6dd93e69ed21; Sat, 17 Oct 2026 14:38:37 +0000 X-Mizu-Trace-ID: 826e6dd93e69ed21 X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Kaiyan Mei , Yinhao Hu , Dongliang Mu , Daniel Borkmann , John Fastabend , Stanislav Fomichev , Martin KaFai Lau , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Shuah Khan , Amery Hung , Martin Teichmann , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v2 1/2] bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields Date: Sat, 17 Oct 2026 22:38:12 +0800 Message-ID: <20261017143819.209510-1-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A BPF program can read the middle of a u64 field in struct bpf_tcp_sock: tp = bpf_tcp_sock(listener); /* +0x54 is in the middle of the u64 bytes_received */ unsigned hi = *(unsigned *)((char *)tp + 0x54); bpf_tcp_sock_is_valid_access() allows this 4-byte read (the default case only checks size == 4), but bpf_tcp_sock_convert_ctx_access() only knows the field starts and has no idea how to handle such an offset. It emits no instruction, cnt stays 0 and the fixup pass trips verifier_bug(): verifier bug: error during ctx access conversion (0) Just disallow the narrower access by matching the whole u64 range of the two fields, so it is turned down at check time: invalid tcp_sock access off=84 size=4 Fixes: 655a51e536c0 ("bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock") Reported-by: Kaiyan Mei Reported-by: Yinhao Hu Reported-by: Dongliang Mu Closes: https://lore.kernel.org/bpf/7a8ff335.1024c.1a14395f3e5.Coremail.kaiyanm@hust.edu.cn/ Signed-off-by: Jiayuan Chen --- v1 -> v2: Add a selftest (Alexei). v1: https://lore.kernel.org/bpf/DM6CTQQV55G1.1AU1HIBPQYW8J@gmail.com/T/#t --- net/core/filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index ba536be2915f..f0eae1c14b2f 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7600,8 +7600,8 @@ bool bpf_tcp_sock_is_valid_access(int off, int size, enum bpf_access_type type, return false; switch (off) { - case offsetof(struct bpf_tcp_sock, bytes_received): - case offsetof(struct bpf_tcp_sock, bytes_acked): + case bpf_ctx_range(struct bpf_tcp_sock, bytes_received): + case bpf_ctx_range(struct bpf_tcp_sock, bytes_acked): return size == sizeof(__u64); default: return size == sizeof(__u32); -- 2.43.0