From: Anton Protopopov <a.s.protopopov@gmail.com>
To: bot+bpf-ci@kernel.org
Cc: bpf@vger.kernel.org, ast@kernel.org, andrii@kernel.org,
daniel@iogearbox.net, martin.lau@kernel.org, eddyz87@gmail.com,
yonghong.song@linux.dev, clm@meta.com, ihor.solodrai@linux.dev
Subject: Re: [PATCH bpf-next] bpf: check for insn arrays in check_ptr_alignment
Date: Fri, 28 Nov 2025 06:22:50 +0000 [thread overview]
Message-ID: <aSk/ugIsUxww5tyT@mail.gmail.com> (raw)
In-Reply-To: <40da69b17d8be21c32270eba8f2c28c20078f03219c37288441322285a1d18d3@mail.kernel.org>
On 25/11/27 09:25PM, bot+bpf-ci@kernel.org wrote:
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 766695491..43991449f 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -6482,6 +6482,8 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
> > break;
> > case PTR_TO_MAP_VALUE:
> > pointer_desc = "value ";
> > + if (reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY)
> > + strict = true;
> > break;
> > case PTR_TO_CTX:
> > pointer_desc = "context ";
> > @@ -7529,8 +7531,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > {
> > struct bpf_reg_state *regs = cur_regs(env);
> > struct bpf_reg_state *reg = regs + regno;
> > - bool insn_array = reg->type == PTR_TO_MAP_VALUE &&
> > - reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY;
> > int size, err = 0;
> >
> > size = bpf_size_to_bytes(bpf_size);
> > @@ -7538,7 +7538,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > return size;
> >
> > /* alignment checks will add in reg->off themselves */
> > - err = check_ptr_alignment(env, reg, off, size, strict_alignment_once || insn_array);
> > + err = check_ptr_alignment(env, reg, off, size, strict_alignment_once);
> > if (err)
> > return err;
>
> The insn_array variable declaration was removed, but this code still
> uses it at check_mem_access():7568. Does this compile?
Robot is right, I should have sent it as a series with
https://lore.kernel.org/bpf/20251127210656.3239541-1-a.s.protopopov@gmail.com/
Will resend it now.
> if (t == BPF_WRITE && insn_array) {
> verbose(env, "writes into insn_array not allowed\n");
> return -EACCES;
> }
>
> The fix would be to check the map type directly:
>
> if (t == BPF_WRITE && reg->type == PTR_TO_MAP_VALUE &&
> reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY) {
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19747897022
prev parent reply other threads:[~2025-11-28 6:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-27 21:07 [PATCH bpf-next] bpf: check for insn arrays in check_ptr_alignment Anton Protopopov
2025-11-27 21:25 ` bot+bpf-ci
2025-11-28 6:22 ` Anton Protopopov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aSk/ugIsUxww5tyT@mail.gmail.com \
--to=a.s.protopopov@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bot+bpf-ci@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=clm@meta.com \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=ihor.solodrai@linux.dev \
--cc=martin.lau@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox