Re: [PATCH bpf-next 2/2] selftests/bpf: Reject scalar store into kptr slot

[Shung-Hsi Yu <shung-hsi.yu@suse.com>]

Cc Ihor since BPF CI should be able to remove map_kptr from deny list
once this is fixed.

On Fri, Apr 17, 2026 at 12:20:06AM +0200, Paul Chaignon wrote:
> On Thu, Apr 16, 2026 at 11:08:08AM -0700, Mykyta Yatsenko wrote:
...
> > +SEC("?tc")
> > +__failure __msg("invalid kptr access, R")
> > +int reject_scalar_store_to_kptr(struct __sk_buff *ctx)
> > +{
> > +	struct map_value *v;
> > +	int key = 0;
> > +
> > +	v = bpf_map_lookup_elem(&array_map, &key);
> > +	if (!v)
> > +		return 0;
> > +
> > +	*(volatile u64 *)&v->unref_ptr = 0xBADC0DE;
> > +	return 0;
> > +}
> > +
...

With test_progs-cpuv4 the error was slightly different due to the use of
BPF_ST instead of BPF_STX, and thus this test will fail due to
mismatched error message:

  run_subtest:PASS:obj_open_mem 0 nsec
  libbpf: prog 'reject_scalar_store_to_kptr': BPF program load failed: -EACCES
  libbpf: prog 'reject_scalar_store_to_kptr': failed to load: -EACCES
  libbpf: failed to load object 'map_kptr_fail'
  run_subtest:PASS:unexpected_load_success 0 nsec
  validate_msgs:FAIL:934 expect_msg
  VERIFIER LOG:
  =============
  0: R1=ctx() R10=fp0
  ; int key = 0; @ map_kptr_fail.c:393
  0: (62) *(u32 *)(r10 -4) = 0          ; R10=fp0 fp-8=0000????
  1: (bf) r2 = r10                      ; R2=fp0 R10=fp0
  2: (07) r2 += -4                      ; R2=fp-4
  ; v = bpf_map_lookup_elem(&array_map, &key); @ map_kptr_fail.c:395
  3: (18) r1 = 0xffff8ddd0bb76c00       ; R1=map_ptr(map=array_map,ks=4,vs=32)
  5: (85) call bpf_map_lookup_elem#1    ; R0=map_value(map=array_map,ks=4,vs=32)
  ; if (!v) @ map_kptr_fail.c:396
  6: (15) if r0 == 0x0 goto pc+1        ; R0=map_value(map=array_map,ks=4,vs=32)
  ; *(volatile u64 *)&v->unref_ptr = 0xBADC0DE; @ map_kptr_fail.c:399
  7: (7a) *(u64 *)(r0 +8) = 195936478
  BPF_ST imm must be 0 when storing to kptr at off=8
  processed 7 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
  =============
  EXPECTED   SUBSTR: 'invalid kptr access, R'
  #214/20  map_kptr/reject_scalar_store_to_kptr:FAIL

Note: currently BPF CI does not test map_kptr due to it being in the
denylist.