Re: [PATCH v3 2/5] bpf/verifier: do not limit maximum direct offset into arena map

[Eduard Zingerman <eddyz87@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1162 bytes --]

On Mon, 2025-12-15 at 11:13 -0500, Emil Tsalapatis wrote:
> The verifier currently limits direct offsets into a map to 512MiB
> to avoid overflow during pointer arithmetic. However, this prevents
> arena maps from using direct addressing instructions to access data
> at the end of > 512MiB arena maps. This is necessary when moving
> arena globals to the end of the arena instead of the front.
> 
> Refactor the verifier code to remove the offset calculation during
> direct value access calculations. This is possible because the only
> two map types that implement .map_direct_value_addr() are arrays and
> arenas, and they both do their own internal checks to ensure the
> offset is within bounds.

Nit: instruction array map also implements it (bpf_insn_array.c).

> 
> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
> ---

I double checked implementations for all 3 map types and confirm that
the above is correct. Also, I commented out the range checks in kernel
implementations (as in the attached patch), and no tests seem to fail.
Do we need to extend selftests?

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

[-- Attachment #2: disable-range-checks.patch --]
[-- Type: text/x-patch, Size: 1704 bytes --]

diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
index 1074ac4459f2..cf38388bb094 100644
--- a/kernel/bpf/arena.c
+++ b/kernel/bpf/arena.c
@@ -388,8 +388,10 @@ static int arena_map_direct_value_addr(const struct bpf_map *map, u64 *imm, u32
 {
 	struct bpf_arena *arena = container_of(map, struct bpf_arena, map);
 
-	if ((u64)off > arena->user_vm_end - arena->user_vm_start)
-		return -ERANGE;
+	/*
+	 * if ((u64)off > arena->user_vm_end - arena->user_vm_start)
+	 * 	return -ERANGE;
+	 */
 	*imm = (unsigned long)arena->user_vm_start;
 	return 0;
 }
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 1eeb31c5b317..e13c58f2e3b8 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -193,8 +193,10 @@ static int array_map_direct_value_addr(const struct bpf_map *map, u64 *imm,
 
 	if (map->max_entries != 1)
 		return -ENOTSUPP;
-	if (off >= map->value_size)
-		return -EINVAL;
+	/*
+	 * if (off >= map->value_size)
+	 * 	return -EINVAL;
+	 */
 
 	*imm = (unsigned long)array->value;
 	return 0;
diff --git a/kernel/bpf/bpf_insn_array.c b/kernel/bpf/bpf_insn_array.c
index c96630cb75bf..aa4b71365541 100644
--- a/kernel/bpf/bpf_insn_array.c
+++ b/kernel/bpf/bpf_insn_array.c
@@ -121,9 +121,11 @@ static int insn_array_map_direct_value_addr(const struct bpf_map *map, u64 *imm,
 {
 	struct bpf_insn_array *insn_array = cast_insn_array(map);
 
-	if ((off % sizeof(long)) != 0 ||
-	    (off / sizeof(long)) >= map->max_entries)
-		return -EINVAL;
+	/*
+	 * if ((off % sizeof(long)) != 0 ||
+	 *     (off / sizeof(long)) >= map->max_entries)
+	 * 	return -EINVAL;
+	 */
 
 	/* from BPF's point of view, this map is a jump table */
 	*imm = (unsigned long)insn_array->ips + off;