[PATCH bpf] bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields

[PATCH bpf] bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields

[Jiayuan Chen]

A BPF program can read the middle of a u64 field in struct bpf_tcp_sock:

	tp = bpf_tcp_sock(listener);
	/* +0x54 is in the middle of the u64 bytes_received */
	unsigned hi = *(unsigned *)((char *)tp + 0x54);

bpf_tcp_sock_is_valid_access() allows this 4-byte read (the default case
only checks size == 4), but bpf_tcp_sock_convert_ctx_access() only knows
the field starts and has no idea how to handle such an offset. It emits
no instruction, cnt stays 0 and the fixup pass trips verifier_bug():

	verifier bug: error during ctx access conversion (0)

Just disallow the narrower access by matching the whole u64 range of the
two fields, so it is turned down at check time:

	invalid tcp_sock access off=84 size=4

Fixes: 655a51e536c0 ("bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock")
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Closes: https://lore.kernel.org/bpf/7a8ff335.1024c.1a14395f3e5.Coremail.kaiyanm@hust.edu.cn/
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/core/filter.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index ba536be2915f..f0eae1c14b2f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -7600,8 +7600,8 @@ bool bpf_tcp_sock_is_valid_access(int off, int size, enum bpf_access_type type,
 		return false;
 
 	switch (off) {
-	case offsetof(struct bpf_tcp_sock, bytes_received):
-	case offsetof(struct bpf_tcp_sock, bytes_acked):
+	case bpf_ctx_range(struct bpf_tcp_sock, bytes_received):
+	case bpf_ctx_range(struct bpf_tcp_sock, bytes_acked):
 		return size == sizeof(__u64);
 	default:
 		return size == sizeof(__u32);
-- 
2.43.0

Re: [PATCH bpf] bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields

[Alexei Starovoitov]

On Fri, Oct 16, 2026 at 07:16 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
> Just disallow the narrower access by matching the whole u64 range of the
> two fields, so it is turned down at check time:
>
> 	invalid tcp_sock access off=84 size=4

Pls add a selftest as patch 2.
progs/verifier_sock.c already has
"bpf_tcp_sock(skb->sk): tp->bytes_acked".
Copy it and do u32 load at offsetof(bytes_received) + 4 and
at offsetof(bytes_acked) + 4 with
__failure __msg("invalid tcp_sock access") __failure_unpriv.
cgroup/skb is loadable by unpriv, so both modes should be covered.
See
commit ba578b87fe2b ("selftests/bpf: Test invalid narrower ctx load")
that Paul added for the same warn in ctx fields.

I'm hesitating to apply it as-is, since all earlier fixes for this
warn came with a test.

pw-bot: cr