From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Jiayuan Chen" <jiayuan.chen@linux.dev>, <bpf@vger.kernel.org>
Cc: "Kaiyan Mei" <M202472210@hust.edu.cn>,
"Yinhao Hu" <dddddd@hust.edu.cn>,
"Dongliang Mu" <dzm91@hust.edu.cn>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"John Fastabend" <john.fastabend@gmail.com>,
"Stanislav Fomichev" <sdf@fomichev.me>,
"Martin KaFai Lau" <martin.lau@linux.dev>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Kumar Kartikeya Dwivedi" <memxor@gmail.com>,
"Song Liu" <song@kernel.org>,
"Yonghong Song" <yonghong.song@linux.dev>,
"Jiri Olsa" <jolsa@kernel.org>,
"Emil Tsalapatis" <emil@etsalapatis.com>,
"Ihor Solodrai" <ihor.solodrai@linux.dev>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@kernel.org>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Simon Horman" <horms@kernel.org>, <netdev@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Subject: Re: [PATCH bpf] bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields
Date: Fri, 16 Oct 2026 15:06:19 +0000 [thread overview]
Message-ID: <DM6CTQQV55G1.1AU1HIBPQYW8J@gmail.com> (raw)
In-Reply-To: <20261016111643.247553-1-jiayuan.chen@linux.dev>
On Fri, Oct 16, 2026 at 07:16 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
> Just disallow the narrower access by matching the whole u64 range of the
> two fields, so it is turned down at check time:
>
> invalid tcp_sock access off=84 size=4
Pls add a selftest as patch 2.
progs/verifier_sock.c already has
"bpf_tcp_sock(skb->sk): tp->bytes_acked".
Copy it and do u32 load at offsetof(bytes_received) + 4 and
at offsetof(bytes_acked) + 4 with
__failure __msg("invalid tcp_sock access") __failure_unpriv.
cgroup/skb is loadable by unpriv, so both modes should be covered.
See
commit ba578b87fe2b ("selftests/bpf: Test invalid narrower ctx load")
that Paul added for the same warn in ctx fields.
I'm hesitating to apply it as-is, since all earlier fixes for this
warn came with a test.
pw-bot: cr
prev parent reply other threads:[~2026-10-16 15:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-16 11:16 [PATCH bpf] bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields Jiayuan Chen
2026-10-16 15:06 ` Alexei Starovoitov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM6CTQQV55G1.1AU1HIBPQYW8J@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=M202472210@hust.edu.cn \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dddddd@hust.edu.cn \
--cc=dzm91@hust.edu.cn \
--cc=eddyz87@gmail.com \
--cc=edumazet@kernel.org \
--cc=emil@etsalapatis.com \
--cc=horms@kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.