Re: [PATCH] bpf: fix special field check with variable offset access

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Sat, Nov 07, 2026 at 05:54 AM Shihuang Liu <shlomojune6@gmail.com> wrote:
> btf_struct_access() rejects direct access to special fields (kptr,
> spin_lock, list/rbtree nodes, ...) of program allocated objects, but
> for variable offset access the check is done at min_off only, while
> the whole [min_off, max_off] range can be reached at runtime. A read
> leaks the pointer; a write corrupts the refcounted pointer and crashes
> the release path (bpf_obj_free_fields -> bpf_mem_free_rcu).

Not the whole range.
The code at check_variable_offset: keeps the access inside one array.
reg->step has to be a multiple of the element size.
Every access lands on the same member of some element.
btf_repeat_fields() repeats the special fields for every element.
So with BTF from a compiler the check at min_off is enough.

I think it takes hand-made BTF with members that overlap:

  struct node {
          u64 arr[4];              offset 0, size 32
          struct foo __kptr *p;    offset 8
  };

btf_struct_check_meta() only rejects offsets that go down.
A store to arr[i], i in [0, 3], passes the check at offset 0 and hits p.

Is that how you got there? Explain in commit log.

Also drop "A read leaks the pointer".
check_ptr_to_btf_access() allows these loads with CAP_PERFMON only.

> -			if (off < offset + field->size && offset < off + size) {
> +			if (min_off < (s64)offset + field->size &&
> +			    (s64)offset < max_off + size) {

This rejects a prog that loads today:

  struct elem { u64 data; struct foo __kptr *p; };
  struct node { struct elem arr[4]; struct foo __kptr *q; };

  n->arr[i].data = 1;      i in [0, 3], step 16

pw-bot: cr