Re: [PATCH bpf 03/11] bpf: Fix bpf_sock context code generation

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 9/16/26 1:08 PM, Emil Tsalapatis wrote:
> Currently, the ctx access code reads the rx_queue_mapping
> field with either a 4-byte or 2-byte load. The rest of the bits
> in the register are marked known zero by the verifier. However,
> the emitted ctx access code places in the register on certain
> the special value (-1) using BPF_MOV_IMM64, which gets sign-extended
> to turn on all the bits in the register. By shifting this value right,
> the program ends up with a value at runtime above what the verifier
> assumes is possible.
>
> Fix this by ensuring the read value is as wide as the assumed size.
> Use MOV32 instructions instead of MOV64 instructions to keep
> the upper bits zero as assumed by the verifier. Also properly report
> the size of the destination variable (the bpf_sock field, 4 bytes) instead
> of the source (the socket field, 2 bytes).
>
> Fixes: c3c16f2ea6d2 ("bpf: Add rx_queue_mapping to bpf_sock")
> Reported-by: Nicholas Carlini <nicholas@carlini.com>
> Suggested-by: Nicholas Carlini <nicholas@carlini.com>
> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


> ---
>   net/core/filter.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 61940e753..5d1705508 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -10565,11 +10565,12 @@ u32 bpf_sock_convert_ctx_access(enum bpf_access_type type,
>   				       target_size));
>   		*insn++ = BPF_JMP_IMM(BPF_JNE, si->dst_reg, NO_QUEUE_MAPPING,
>   				      1);
> -		*insn++ = BPF_MOV64_IMM(si->dst_reg, -1);
> +		*insn++ = BPF_MOV32_IMM(si->dst_reg, -1);
>   #else
> -		*insn++ = BPF_MOV64_IMM(si->dst_reg, -1);
> -		*target_size = 2;
> +		*insn++ = BPF_MOV32_IMM(si->dst_reg, -1);
>   #endif
> +		*target_size = sizeof_field(struct bpf_sock, rx_queue_mapping);
> +
>   		break;
>   	}
>