[PATCH bpf-next] bpf: Emit verbose message when prog-specific btf_struct_access rejects a write

[PATCH bpf-next] bpf: Emit verbose message when prog-specific btf_struct_access rejects a write

[Alexei Starovoitov]

From: Alexei Starovoitov <ast@kernel.org>

When BPF_WRITE goes through a PTR_TO_BTF_ID register, check_ptr_to_btf_access()
delegates to env->ops->btf_struct_access(). Most implementations
(bpf_scx_btf_struct_access, tc_cls_act_btf_struct_access, etc.) return
-EACCES for disallowed fields without logging anything, so the verifier
rejects the program with an empty message. For example a scx program doing

  1: R1=trusted_ptr_task_struct()
  ...
  4: (7b) *(u64 *)(r1 +0) = r2
  verification time 83 usec
  the program is rejected

leaves the user guessing which field is off-limits.
Emit verbose message.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
 kernel/bpf/verifier.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 2abc79dbf281..030505c8f3e2 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5786,6 +5786,10 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 			return -EFAULT;
 		}
 		ret = env->ops->btf_struct_access(&env->log, reg, off, size);
+		if (ret < 0)
+			verbose(env,
+				"%s cannot write into ptr_%s at off=%d size=%d\n",
+				reg_arg_name(env, argno), tname, off, size);
 	} else {
 		/* Writes are permitted with default btf_struct_access for
 		 * program allocated objects (which always have id > 0),
-- 
2.53.0-Meta

Re: [PATCH bpf-next] bpf: Emit verbose message when prog-specific btf_struct_access rejects a write

[Emil Tsalapatis]

On Mon Jun 15, 2026 at 7:21 PM EDT, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
>
> When BPF_WRITE goes through a PTR_TO_BTF_ID register, check_ptr_to_btf_access()
> delegates to env->ops->btf_struct_access(). Most implementations
> (bpf_scx_btf_struct_access, tc_cls_act_btf_struct_access, etc.) return
> -EACCES for disallowed fields without logging anything, so the verifier
> rejects the program with an empty message. For example a scx program doing
>
>   1: R1=trusted_ptr_task_struct()
>   ...
>   4: (7b) *(u64 *)(r1 +0) = r2
>   verification time 83 usec
>   the program is rejected
>
> leaves the user guessing which field is off-limits.
> Emit verbose message.
>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  kernel/bpf/verifier.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 2abc79dbf281..030505c8f3e2 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5786,6 +5786,10 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
>  			return -EFAULT;
>  		}
>  		ret = env->ops->btf_struct_access(&env->log, reg, off, size);
> +		if (ret < 0)
> +			verbose(env,
> +				"%s cannot write into ptr_%s at off=%d size=%d\n",
> +				reg_arg_name(env, argno), tname, off, size);
>  	} else {
>  		/* Writes are permitted with default btf_struct_access for
>  		 * program allocated objects (which always have id > 0),

Re: [PATCH bpf-next] bpf: Emit verbose message when prog-specific btf_struct_access rejects a write

[Yonghong Song]

On 6/15/26 4:21 PM, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
>
> When BPF_WRITE goes through a PTR_TO_BTF_ID register, check_ptr_to_btf_access()
> delegates to env->ops->btf_struct_access(). Most implementations
> (bpf_scx_btf_struct_access, tc_cls_act_btf_struct_access, etc.) return
> -EACCES for disallowed fields without logging anything, so the verifier
> rejects the program with an empty message. For example a scx program doing
>
>    1: R1=trusted_ptr_task_struct()
>    ...
>    4: (7b) *(u64 *)(r1 +0) = r2
>    verification time 83 usec
>    the program is rejected
>
> leaves the user guessing which field is off-limits.
> Emit verbose message.
>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Indeed, e.g. bpf_scx_btf_struct_access() does not emit any verifier log
for failure. So it makes sense to have a generic verifier log after
env->ops->btf_struct_access().

Acked-by: Yonghong Song <yonghong.song@linux.dev>