Re: [PATCH bpf v2] bpf: Check variable-offset accesses against special fields

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Sun, Nov 08, 2026 at 07:29 AM Shihuang Liu <shlomojune6@gmail.com> wrote:
> Check every offset the register can take (min_off + k * step)
> against the record.  Constant offsets keep the existing check.

No need for the helper and the second loop.
reg->step is never 0. ___mark_reg_known() sets it to 1 and
reg_bounds_sanity_check() reports 0 as a verifier bug.
So a constant offset is the k == 0 case of the same check.

Something like this (compile tested only):

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 8bf3909..2265362 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -8094,7 +8094,12 @@ int btf_struct_access(struct bpf_verifier_log *log,
 		for (i = 0; i < rec->cnt; i++) {
 			struct btf_field *field = &rec->fields[i];
 			u32 offset = field->offset;
-			if (off < offset + field->size && offset < off + size) {
+			/* An access at 'lo' or above ends after the start of the field. */
+			s64 lo = max(min_off, (s64)offset - size + 1);
+
+			/* Round up to min_off + k * step. The step is never 0. */
+			lo += imod(min_off - lo, reg->step);
+			if (lo <= max_off && lo < offset + field->size) {
 				bpf_log(log,
 					"direct access to %s is disallowed\n",
 					btf_field_type_name(field->type));


The store to arr[i] from the commit log. It loads today. With the fix
the verifier says "direct access to kptr is disallowed".
clang can't emit such BTF. Compile the struct with p at offset 16.
After __open() move p to offset 8 in bpf_object__btf(), then load.

The store to arr[i].data from my reply to v1. It has to keep loading.

pw-bot: cr