Re: [PATCH bpf-next 2/2] selftests/bpf: Reject scalar store into kptr slot

[Paul Chaignon <paul.chaignon@gmail.com>]

On Thu, Apr 16, 2026 at 11:08:08AM -0700, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
> 
> Verify that the verifier rejects a direct scalar write to a kptr map
> value slot without crashing.
> 
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

The test makes sense and causes a NULL pointer dereference as expected
when the fix isn't applied.

Acked-by: Paul Chaignon <paul.chaignon@gmail.com>

> ---
>  tools/testing/selftests/bpf/progs/map_kptr_fail.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/map_kptr_fail.c b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
> index 6443b320c732..ee053b24e6ca 100644
> --- a/tools/testing/selftests/bpf/progs/map_kptr_fail.c
> +++ b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
> @@ -385,4 +385,19 @@ int kptr_xchg_possibly_null(struct __sk_buff *ctx)
>  	return 0;
>  }
>  
> +SEC("?tc")
> +__failure __msg("invalid kptr access, R")
> +int reject_scalar_store_to_kptr(struct __sk_buff *ctx)
> +{
> +	struct map_value *v;
> +	int key = 0;
> +
> +	v = bpf_map_lookup_elem(&array_map, &key);
> +	if (!v)
> +		return 0;
> +
> +	*(volatile u64 *)&v->unref_ptr = 0xBADC0DE;
> +	return 0;
> +}
> +
>  char _license[] SEC("license") = "GPL";
> 
> -- 
> 2.52.0
> 
>