Re: [PATCH v3 2/5] bpf/verifier: do not limit maximum direct offset into arena map

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Tue Dec 16, 2025 at 3:13 PM EST, Eduard Zingerman wrote:
> On Tue, 2025-12-16 at 12:25 -0500, Emil Tsalapatis wrote:
>> On Mon Dec 15, 2025 at 3:19 PM EST, Eduard Zingerman wrote:
>> > On Mon, 2025-12-15 at 11:13 -0500, Emil Tsalapatis wrote:
>> > > The verifier currently limits direct offsets into a map to 512MiB
>> > > to avoid overflow during pointer arithmetic. However, this prevents
>> > > arena maps from using direct addressing instructions to access data
>> > > at the end of > 512MiB arena maps. This is necessary when moving
>> > > arena globals to the end of the arena instead of the front.
>> > >
>> > > Refactor the verifier code to remove the offset calculation during
>> > > direct value access calculations. This is possible because the only
>> > > two map types that implement .map_direct_value_addr() are arrays and
>> > > arenas, and they both do their own internal checks to ensure the
>> > > offset is within bounds.
>> >
>> > Nit: instruction array map also implements it (bpf_insn_array.c).
>> >
>> > >
>> > > Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
>> > > ---
>> >
>> > I double checked implementations for all 3 map types and confirm that
>> > the above is correct. Also, I commented out the range checks in kernel
>> > implementations (as in the attached patch), and no tests seem to fail.
>> > Do we need to extend selftests?
>>
>> I forgot to address a couple selftest errors from this patch in this version,
>> but after fixing them for v4 and applying the attached patch I am getting a
>> couple failures - direct map access tests #332, #334, #336, #337, #338, #345.
>
> Uh-oh, sorry, I forgot about test_verifier binary.
>
>> #332 (write test 7) is an unexpected load success, while the rest are about a
>> mismatch in the error message. Maybe the test wasn't being marked as an
>> unexpected success because I hadn't fixed it up?
>
> For me it shows:
>
>   #332/p direct map access, write test 7 FAIL
>   Unexpected verifier log!
>   EXP: direct value offset of 4294967295 is not allowed
>   RES:
>   FAIL
>   Unexpected error message!
>           EXP: direct value offset of 4294967295 is not allowed
>           RES: invalid access to map value pointer, value_size=48 off=4294967295
>
> So, seem to be an expected behavior given your changes?

Yes, for v3 this was the expected behavior: The tests used to trigger
the old error msg (in EXP), but even after removing it they fail
because the map isn't actually large enough to support the value
offset offset of the tests ((-1) and (1UL << 29) for tests 7 and
12). The RES output is from the .map_direct_value_addr() method
doing bounds checking and rejecting the out-of-bounds offset.