Re: [PATCH v2] bpf: add diagnostics for rejected memory and map accesses

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Mon, Sep 28, 2026 at 01:12 AM Suchit Karunakaran <suchitkarunakaran@gmail.com> wrote:
> @@ -4472,12 +4472,22 @@ static int check_map_access_type(struct bpf_verifier_env *env, struct bpf_reg_st
>  	if (type == BPF_WRITE && !(cap & BPF_MAP_CAN_WRITE)) {
>  		verbose(env, "write into map forbidden, value_size=%d off=%lld size=%d\n",
>  			map->value_size, reg_smin(reg) + off, size);
> +		bpf_diag_policy(env, env->insn_idx,
> +				bpf_diag_fmt(env, "write to map '%s'",
> +					map->name[0] ? map->name : "unnamed"),
> +				"this map was created with BPF_F_RDONLY_PROG, which allows BPF programs to only read it",
> +				"Remove the write, or create the map without BPF_F_RDONLY_PROG if BPF programs need to write to it.");

That's not true.
dev_map_init_map() and insn_array_alloc() set BPF_F_RDONLY_PROG
in the kernel for every devmap and insn_array.
libbpf sets it for .rodata when the prog has a const global.
The user didn't create the map with that flag and
cannot create it without.
Same in record_func_map().

[...]

> @@ -6944,6 +6954,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
> +					"Use a writable destination, or copy the data into a writable buffer before modifying it.");

[...]

> @@ -7032,6 +7046,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
> +					"Remove the direct write, or perform the modification in a program type and hook that support packet writes.");

These two are the same as in v1 and don't tell the user anything.

Pls focus your tokens elsewhere. I don't feel we will converge here.

pw-bot: cr