Re: [PATCH bpf-next v1 3/4] bpf: Reject modified syscall PTR_TO_CTX for global subprogs

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Tue Mar 17, 2026 at 7:18 AM EDT, Kumar Kartikeya Dwivedi wrote:
> Now that syscall programs allow modified offsets to be passed as a
> context argument, we must make sure that they are passed unmodified to
> global subprogs. The reasoning is that we can have inconsistent and
> potentially unsafe max_ctx_offset based checks if the global subprog is
> used to access the ctx, or when it is replaced by an extension prog.
> We'll need a post-processing pass to correctly identify the
> max_ctx_offset across the call graph, but it's extra work for little
> functional gain, hence just reject this case.
>
> We have to make this change now, since we opened up the checks made in
> check_func_arg_reg_off for BPF_PROG_TYPE_SYSCALL's PTR_TO_CTX in past
> commits.
>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

Whether we end up merging it into patch #1 or not, the logic is correct.

> ---
>  kernel/bpf/verifier.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 50639bb69d91..3f34510ec183 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -10778,6 +10778,17 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
>  				bpf_log(log, "arg#%d expects pointer to ctx\n", i);
>  				return -EINVAL;
>  			}
> +			/*
> +			 * We should not allow modified offset ctx to be passed
> +			 * into global subprogs, to avoid messing up the math of
> +			 * max_ctx_offset for the whole program. Supporting this
> +			 * will require a post-verification pass, not worth it.
> +			 */
> +			if (resolve_prog_type(env->prog) == BPF_PROG_TYPE_SYSCALL &&
> +			    (!tnum_is_const(reg->var_off) || reg->var_off.value)) {
> +				bpf_log(log, "arg#%d of syscall prog must have zero offset\n", i);
> +				return -EINVAL;
> +			}
>  		} else if (base_type(arg->arg_type) == ARG_PTR_TO_MEM) {
>  			ret = check_func_arg_reg_off(env, reg, regno, ARG_DONTCARE);
>  			if (ret < 0)