Re: [PATCH bpf v3 0/2] bpf: reject negative CO-RE accessor indices

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Sat Apr 4, 2026 at 12:12 PM EDT, Weiming Shi wrote:
> bpf_core_parse_spec() parses CO-RE accessor strings with sscanf("%d"),
> which accepts negative values.  The downstream bounds checks only test
> the upper bound, so a negative index like -1 slips through, gets cast
> to u32 0xffffffff in btf_member_bit_offset(), and crashes the kernel.
>
> To clarify the kernel-side concern from v2 review:
> tools/lib/bpf/relo_core.c is shared code -- the kernel compiles it
> directly via kernel/bpf/relo_core.c (#include).  So the fix does
> apply in the kernel's BPF_PROG_LOAD -> check_core_relo() ->
> bpf_core_apply() -> bpf_core_parse_spec() path.
>

Since this text ends up in the git log, I think you can remove this
paragraph - especially since there is no permalink in the version
history below.

> v3: added selftest (patch 2/2)
> v2: fix typo Signed-off-by tag (missing leading 'S')
>
> Weiming Shi (2):
>   bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
>   selftests/bpf: add test for negative CO-RE accessor index rejection
>
>  tools/lib/bpf/relo_core.c                     |  2 +
>  .../selftests/bpf/prog_tests/core_reloc_raw.c | 94 +++++++++++++++++++
>  2 files changed, 96 insertions(+)