From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-57.mta0.migadu.com [91.218.175.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB54238F64D for ; Fri, 16 Oct 2026 11:17:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.57 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792149423; cv=none; b=r4hMnbMRIzsJ05/Ix4kX+R4r7JHcuo3gqrBHcU6ytt0/+tZyJrB0yZcZRZMx1q61uQ/+RqlMiN+AuXg97F8UW/ahkwdG41YJ+6BRhEuKI96EXqJ1raxMhYTJmymSgLUTgvhCzE2bo5Ok3iZBisdpSnynXVzagBwlQPzmSkt9UQI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792149423; c=relaxed/simple; bh=WZ6dLcgrQjwdEPJGDFfYZRVQIr0dB7OD7+Bd/3cCH8k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ud4MrL4DWqubOFanCd6zdvZUnWVt65JT1SjE82zmd7eGpF/xz9UvVsQPkI7rRV0wCAxH8QrMzk41+JUvgNkvgjpjUdvMw5lXIQQ56ihK0uMOSDPd1qL8YJidmfUUC8taJs+kMFyvglij5IK0FbT5ux6+jmhx3kDUUktiWODnSWw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=OeMMXyzT; arc=none smtp.client-ip=91.218.175.57 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="OeMMXyzT" X-Envelope-To: bpf@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=WZ6dLcgrQjwdEPJGDFfYZRVQIr0dB7OD7+Bd/3cCH8k=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1792149418; v=1; x=1792754218; b=OeMMXyzTDIop3AzZOaNY4CwfOsebZLkr1rUB3Md96Sqdb4IjuPjb2Ze6fbnFeqceS6Tbcdpo 3Aklpw6M7vBprnBBSYPmsPkkSYrKset75kvv2Pm0dxP11Wruc+C3er0h2y4CRTgNoMhSkzjpQBw Sv9rWf9sGIx+SGCMyq8l/mfg= X-Envelope-To: bpf@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 8fa13fae177cef9b; Fri, 16 Oct 2026 11:16:58 +0000 X-Mizu-Trace-ID: 8fa13fae177cef9b X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Kaiyan Mei , Yinhao Hu , Dongliang Mu , Daniel Borkmann , John Fastabend , Stanislav Fomichev , Martin KaFai Lau , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH bpf] bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields Date: Fri, 16 Oct 2026 19:16:42 +0800 Message-ID: <20261016111643.247553-1-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A BPF program can read the middle of a u64 field in struct bpf_tcp_sock: tp = bpf_tcp_sock(listener); /* +0x54 is in the middle of the u64 bytes_received */ unsigned hi = *(unsigned *)((char *)tp + 0x54); bpf_tcp_sock_is_valid_access() allows this 4-byte read (the default case only checks size == 4), but bpf_tcp_sock_convert_ctx_access() only knows the field starts and has no idea how to handle such an offset. It emits no instruction, cnt stays 0 and the fixup pass trips verifier_bug(): verifier bug: error during ctx access conversion (0) Just disallow the narrower access by matching the whole u64 range of the two fields, so it is turned down at check time: invalid tcp_sock access off=84 size=4 Fixes: 655a51e536c0 ("bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock") Reported-by: Kaiyan Mei Reported-by: Yinhao Hu Reported-by: Dongliang Mu Closes: https://lore.kernel.org/bpf/7a8ff335.1024c.1a14395f3e5.Coremail.kaiyanm@hust.edu.cn/ Signed-off-by: Jiayuan Chen --- net/core/filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index ba536be2915f..f0eae1c14b2f 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7600,8 +7600,8 @@ bool bpf_tcp_sock_is_valid_access(int off, int size, enum bpf_access_type type, return false; switch (off) { - case offsetof(struct bpf_tcp_sock, bytes_received): - case offsetof(struct bpf_tcp_sock, bytes_acked): + case bpf_ctx_range(struct bpf_tcp_sock, bytes_received): + case bpf_ctx_range(struct bpf_tcp_sock, bytes_acked): return size == sizeof(__u64); default: return size == sizeof(__u32); -- 2.43.0