* [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access
@ 2025-09-17 8:07 Paul Chaignon
2025-09-17 8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17 8:07 UTC (permalink / raw)
To: bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Martin KaFai Lau, Eduard Zingerman
This patchset fixes bpf_sock_addr padding access to avoid a kernel
warning and improves our selftests coverage for these ctx padding cases.
Changes in v2:
- Rebased on top of bpf-next.
- Added selftests for paddings in bpf_sock and sk_reuseport_md.
- Simplified sock_addr_is_valid_access's logic, as suggested by Daniel.
- Removed a tab copied from existing code and spotted by Eduard.
Paul Chaignon (3):
bpf: Explicitly check accesses to bpf_sock_addr
selftests/bpf: Move macros to bpf_misc.h
selftest/bpf: Test accesses to ctx padding
net/core/filter.c | 16 ++++++----
tools/testing/selftests/bpf/progs/bpf_misc.h | 4 +++
.../selftests/bpf/progs/test_cls_redirect.c | 4 +--
.../bpf/progs/test_tcp_hdr_options.c | 5 +--
.../selftests/bpf/progs/verifier_ctx.c | 32 +++++++++++++++++--
.../selftests/bpf/progs/verifier_sock.c | 4 ---
6 files changed, 46 insertions(+), 19 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr
2025-09-17 8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
@ 2025-09-17 8:08 ` Paul Chaignon
2025-09-17 8:09 ` [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h Paul Chaignon
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17 8:08 UTC (permalink / raw)
To: bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Martin KaFai Lau, Eduard Zingerman
Syzkaller found a kernel warning on the following sock_addr program:
0: r0 = 0
1: r2 = *(u32 *)(r1 +60)
2: exit
which triggers:
verifier bug: error during ctx access conversion (0)
This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.
This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.
I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.
Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
net/core/filter.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 63f3baee2daf..8342f810ad85 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9284,13 +9284,17 @@ static bool sock_addr_is_valid_access(int off, int size,
return false;
info->reg_type = PTR_TO_SOCKET;
break;
- default:
- if (type == BPF_READ) {
- if (size != size_default)
- return false;
- } else {
+ case bpf_ctx_range(struct bpf_sock_addr, user_family):
+ case bpf_ctx_range(struct bpf_sock_addr, family):
+ case bpf_ctx_range(struct bpf_sock_addr, type):
+ case bpf_ctx_range(struct bpf_sock_addr, protocol):
+ if (type != BPF_READ)
return false;
- }
+ if (size != size_default)
+ return false;
+ break;
+ default:
+ return false;
}
return true;
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h
2025-09-17 8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
2025-09-17 8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
@ 2025-09-17 8:09 ` Paul Chaignon
2025-09-17 8:10 ` [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding Paul Chaignon
2025-09-17 14:20 ` [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17 8:09 UTC (permalink / raw)
To: bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Martin KaFai Lau, Eduard Zingerman
Move the sizeof_field and offsetofend macros from individual test files
to the common bpf_misc.h to avoid duplication.
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
tools/testing/selftests/bpf/progs/bpf_misc.h | 4 ++++
tools/testing/selftests/bpf/progs/test_cls_redirect.c | 4 +---
tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c | 5 +----
tools/testing/selftests/bpf/progs/verifier_ctx.c | 2 --
tools/testing/selftests/bpf/progs/verifier_sock.c | 4 ----
5 files changed, 6 insertions(+), 13 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/bpf_misc.h b/tools/testing/selftests/bpf/progs/bpf_misc.h
index 7905396c9cc4..1004c4a64aaf 100644
--- a/tools/testing/selftests/bpf/progs/bpf_misc.h
+++ b/tools/testing/selftests/bpf/progs/bpf_misc.h
@@ -167,6 +167,10 @@
#define __imm_ptr(name) [name]"r"(&name)
#define __imm_insn(name, expr) [name]"i"(*(long *)&(expr))
+#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
+#define offsetofend(TYPE, MEMBER) \
+ (offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
+
/* Magic constants used with __retval() */
#define POINTER_VALUE 0xbadcafe
#define TEST_DATA_LEN 64
diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect.c b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
index 823169fb6e4c..26a53e54b8fa 100644
--- a/tools/testing/selftests/bpf/progs/test_cls_redirect.c
+++ b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
@@ -22,6 +22,7 @@
#include "bpf_compiler.h"
#include "test_cls_redirect.h"
+#include "bpf_misc.h"
#pragma GCC diagnostic ignored "-Waddress-of-packed-member"
@@ -31,9 +32,6 @@
#define INLINING __always_inline
#endif
-#define offsetofend(TYPE, MEMBER) \
- (offsetof(TYPE, MEMBER) + sizeof((((TYPE *)0)->MEMBER)))
-
#define IP_OFFSET_MASK (0x1FFF)
#define IP_MF (0x2000)
diff --git a/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c b/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c
index 5f4e87ee949a..1ecdf4c54de4 100644
--- a/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c
+++ b/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c
@@ -14,10 +14,7 @@
#include <bpf/bpf_endian.h>
#define BPF_PROG_TEST_TCP_HDR_OPTIONS
#include "test_tcp_hdr_options.h"
-
-#ifndef sizeof_field
-#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
-#endif
+#include "bpf_misc.h"
__u8 test_kind = TCPOPT_EXP;
__u16 test_magic = 0xeB9F;
diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx.c b/tools/testing/selftests/bpf/progs/verifier_ctx.c
index 424463094760..b927906aa305 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ctx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ctx.c
@@ -5,8 +5,6 @@
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
-#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
-
SEC("tc")
__description("context stores via BPF_ATOMIC")
__failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed")
diff --git a/tools/testing/selftests/bpf/progs/verifier_sock.c b/tools/testing/selftests/bpf/progs/verifier_sock.c
index 0d5e56dffabb..bf88c644eb30 100644
--- a/tools/testing/selftests/bpf/progs/verifier_sock.c
+++ b/tools/testing/selftests/bpf/progs/verifier_sock.c
@@ -5,10 +5,6 @@
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
-#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
-#define offsetofend(TYPE, MEMBER) \
- (offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
-
struct {
__uint(type, BPF_MAP_TYPE_REUSEPORT_SOCKARRAY);
__uint(max_entries, 1);
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding
2025-09-17 8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
2025-09-17 8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
2025-09-17 8:09 ` [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h Paul Chaignon
@ 2025-09-17 8:10 ` Paul Chaignon
2025-09-17 14:20 ` [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17 8:10 UTC (permalink / raw)
To: bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Martin KaFai Lau, Eduard Zingerman
This patch adds tests covering the various paddings in ctx structures.
In case of sk_lookup BPF programs, the behavior is a bit different
because accesses to the padding are explicitly allowed. Other cases
result in a clear reject from the verifier.
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
.../selftests/bpf/progs/verifier_ctx.c | 30 +++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx.c b/tools/testing/selftests/bpf/progs/verifier_ctx.c
index b927906aa305..5ebf7d9bcc55 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ctx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ctx.c
@@ -262,4 +262,34 @@ narrow_load("sockops", bpf_sock_ops, skb_hwtstamp);
unaligned_access("flow_dissector", __sk_buff, data);
unaligned_access("netfilter", bpf_nf_ctx, skb);
+#define padding_access(type, ctx, prev_field, sz) \
+ SEC(type) \
+ __description("access on " #ctx " padding after " #prev_field) \
+ __naked void padding_ctx_access_##ctx(void) \
+ { \
+ asm volatile (" \
+ r1 = *(u%[size] *)(r1 + %[off]); \
+ r0 = 0; \
+ exit;" \
+ : \
+ : __imm_const(size, sz * 8), \
+ __imm_const(off, offsetofend(struct ctx, prev_field)) \
+ : __clobber_all); \
+ }
+
+__failure __msg("invalid bpf_context access")
+padding_access("cgroup/bind4", bpf_sock_addr, msg_src_ip6[3], 4);
+
+__success
+padding_access("sk_lookup", bpf_sk_lookup, remote_port, 2);
+
+__failure __msg("invalid bpf_context access")
+padding_access("tc", __sk_buff, tstamp_type, 2);
+
+__failure __msg("invalid bpf_context access")
+padding_access("cgroup/post_bind4", bpf_sock, dst_port, 2);
+
+__failure __msg("invalid bpf_context access")
+padding_access("sk_reuseport", sk_reuseport_md, hash, 4);
+
char _license[] SEC("license") = "GPL";
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access
2025-09-17 8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
` (2 preceding siblings ...)
2025-09-17 8:10 ` [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding Paul Chaignon
@ 2025-09-17 14:20 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-09-17 14:20 UTC (permalink / raw)
To: Paul Chaignon; +Cc: bpf, ast, daniel, andrii, martin.lau, eddyz87
Hello:
This series was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:
On Wed, 17 Sep 2025 10:07:08 +0200 you wrote:
> This patchset fixes bpf_sock_addr padding access to avoid a kernel
> warning and improves our selftests coverage for these ctx padding cases.
>
> Changes in v2:
> - Rebased on top of bpf-next.
> - Added selftests for paddings in bpf_sock and sk_reuseport_md.
> - Simplified sock_addr_is_valid_access's logic, as suggested by Daniel.
> - Removed a tab copied from existing code and spotted by Eduard.
>
> [...]
Here is the summary with links:
- [bpf-next,v2,1/3] bpf: Explicitly check accesses to bpf_sock_addr
https://git.kernel.org/bpf/bpf-next/c/6fabca2fc94d
- [bpf-next,v2,2/3] selftests/bpf: Move macros to bpf_misc.h
https://git.kernel.org/bpf/bpf-next/c/7c60f6e488b7
- [bpf-next,v2,3/3] selftest/bpf: Test accesses to ctx padding
https://git.kernel.org/bpf/bpf-next/c/180a46bc1a1c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-09-17 14:20 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-17 8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
2025-09-17 8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
2025-09-17 8:09 ` [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h Paul Chaignon
2025-09-17 8:10 ` [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding Paul Chaignon
2025-09-17 14:20 ` [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.