[PATCH bpf-next v2 0/3] Avoid warning on bpf_sock

BPF List
 help / color / mirror / Atom feed

* [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access
@ 2025-09-17  8:07 Paul Chaignon
  2025-09-17  8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17  8:07 UTC (permalink / raw)
  To: bpf
  Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
	Martin KaFai Lau, Eduard Zingerman

This patchset fixes bpf_sock_addr padding access to avoid a kernel
warning and improves our selftests coverage for these ctx padding cases.

Changes in v2:
  - Rebased on top of bpf-next.
  - Added selftests for paddings in bpf_sock and sk_reuseport_md.
  - Simplified sock_addr_is_valid_access's logic, as suggested by Daniel.
  - Removed a tab copied from existing code and spotted by Eduard.

Paul Chaignon (3):
  bpf: Explicitly check accesses to bpf_sock_addr
  selftests/bpf: Move macros to bpf_misc.h
  selftest/bpf: Test accesses to ctx padding

 net/core/filter.c                             | 16 ++++++----
 tools/testing/selftests/bpf/progs/bpf_misc.h  |  4 +++
 .../selftests/bpf/progs/test_cls_redirect.c   |  4 +--
 .../bpf/progs/test_tcp_hdr_options.c          |  5 +--
 .../selftests/bpf/progs/verifier_ctx.c        | 32 +++++++++++++++++--
 .../selftests/bpf/progs/verifier_sock.c       |  4 ---
 6 files changed, 46 insertions(+), 19 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr
  2025-09-17  8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
@ 2025-09-17  8:08 ` Paul Chaignon
  2025-09-17  8:09 ` [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h Paul Chaignon
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17  8:08 UTC (permalink / raw)
  To: bpf
  Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
	Martin KaFai Lau, Eduard Zingerman

Syzkaller found a kernel warning on the following sock_addr program:

    0: r0 = 0
    1: r2 = *(u32 *)(r1 +60)
    2: exit

which triggers:

    verifier bug: error during ctx access conversion (0)

This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.

This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.

I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.

Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
 net/core/filter.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 63f3baee2daf..8342f810ad85 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9284,13 +9284,17 @@ static bool sock_addr_is_valid_access(int off, int size,
 			return false;
 		info->reg_type = PTR_TO_SOCKET;
 		break;
-	default:
-		if (type == BPF_READ) {
-			if (size != size_default)
-				return false;
-		} else {
+	case bpf_ctx_range(struct bpf_sock_addr, user_family):
+	case bpf_ctx_range(struct bpf_sock_addr, family):
+	case bpf_ctx_range(struct bpf_sock_addr, type):
+	case bpf_ctx_range(struct bpf_sock_addr, protocol):
+		if (type != BPF_READ)
 			return false;
-		}
+		if (size != size_default)
+			return false;
+		break;
+	default:
+		return false;
 	}
 
 	return true;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h
  2025-09-17  8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
  2025-09-17  8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
@ 2025-09-17  8:09 ` Paul Chaignon
  2025-09-17  8:10 ` [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding Paul Chaignon
  2025-09-17 14:20 ` [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access patchwork-bot+netdevbpf
  3 siblings, 0 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17  8:09 UTC (permalink / raw)
  To: bpf
  Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
	Martin KaFai Lau, Eduard Zingerman

Move the sizeof_field and offsetofend macros from individual test files
to the common bpf_misc.h to avoid duplication.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
 tools/testing/selftests/bpf/progs/bpf_misc.h             | 4 ++++
 tools/testing/selftests/bpf/progs/test_cls_redirect.c    | 4 +---
 tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c | 5 +----
 tools/testing/selftests/bpf/progs/verifier_ctx.c         | 2 --
 tools/testing/selftests/bpf/progs/verifier_sock.c        | 4 ----
 5 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/bpf_misc.h b/tools/testing/selftests/bpf/progs/bpf_misc.h
index 7905396c9cc4..1004c4a64aaf 100644
--- a/tools/testing/selftests/bpf/progs/bpf_misc.h
+++ b/tools/testing/selftests/bpf/progs/bpf_misc.h
@@ -167,6 +167,10 @@
 #define __imm_ptr(name) [name]"r"(&name)
 #define __imm_insn(name, expr) [name]"i"(*(long *)&(expr))
 
+#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
+#define offsetofend(TYPE, MEMBER) \
+	(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
+
 /* Magic constants used with __retval() */
 #define POINTER_VALUE	0xbadcafe
 #define TEST_DATA_LEN	64
diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect.c b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
index 823169fb6e4c..26a53e54b8fa 100644
--- a/tools/testing/selftests/bpf/progs/test_cls_redirect.c
+++ b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
@@ -22,6 +22,7 @@
 
 #include "bpf_compiler.h"
 #include "test_cls_redirect.h"
+#include "bpf_misc.h"
 
 #pragma GCC diagnostic ignored "-Waddress-of-packed-member"
 
@@ -31,9 +32,6 @@
 #define INLINING __always_inline
 #endif
 
-#define offsetofend(TYPE, MEMBER) \
-	(offsetof(TYPE, MEMBER) + sizeof((((TYPE *)0)->MEMBER)))
-
 #define IP_OFFSET_MASK (0x1FFF)
 #define IP_MF (0x2000)
 
diff --git a/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c b/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c
index 5f4e87ee949a..1ecdf4c54de4 100644
--- a/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c
+++ b/tools/testing/selftests/bpf/progs/test_tcp_hdr_options.c
@@ -14,10 +14,7 @@
 #include <bpf/bpf_endian.h>
 #define BPF_PROG_TEST_TCP_HDR_OPTIONS
 #include "test_tcp_hdr_options.h"
-
-#ifndef sizeof_field
-#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
-#endif
+#include "bpf_misc.h"
 
 __u8 test_kind = TCPOPT_EXP;
 __u16 test_magic = 0xeB9F;
diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx.c b/tools/testing/selftests/bpf/progs/verifier_ctx.c
index 424463094760..b927906aa305 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ctx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ctx.c
@@ -5,8 +5,6 @@
 #include <bpf/bpf_helpers.h>
 #include "bpf_misc.h"
 
-#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
-
 SEC("tc")
 __description("context stores via BPF_ATOMIC")
 __failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed")
diff --git a/tools/testing/selftests/bpf/progs/verifier_sock.c b/tools/testing/selftests/bpf/progs/verifier_sock.c
index 0d5e56dffabb..bf88c644eb30 100644
--- a/tools/testing/selftests/bpf/progs/verifier_sock.c
+++ b/tools/testing/selftests/bpf/progs/verifier_sock.c
@@ -5,10 +5,6 @@
 #include <bpf/bpf_helpers.h>
 #include "bpf_misc.h"
 
-#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
-#define offsetofend(TYPE, MEMBER) \
-	(offsetof(TYPE, MEMBER)	+ sizeof_field(TYPE, MEMBER))
-
 struct {
 	__uint(type, BPF_MAP_TYPE_REUSEPORT_SOCKARRAY);
 	__uint(max_entries, 1);
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding
  2025-09-17  8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
  2025-09-17  8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
  2025-09-17  8:09 ` [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h Paul Chaignon
@ 2025-09-17  8:10 ` Paul Chaignon
  2025-09-17 14:20 ` [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access patchwork-bot+netdevbpf
  3 siblings, 0 replies; 5+ messages in thread
From: Paul Chaignon @ 2025-09-17  8:10 UTC (permalink / raw)
  To: bpf
  Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
	Martin KaFai Lau, Eduard Zingerman

This patch adds tests covering the various paddings in ctx structures.
In case of sk_lookup BPF programs, the behavior is a bit different
because accesses to the padding are explicitly allowed. Other cases
result in a clear reject from the verifier.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
 .../selftests/bpf/progs/verifier_ctx.c        | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx.c b/tools/testing/selftests/bpf/progs/verifier_ctx.c
index b927906aa305..5ebf7d9bcc55 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ctx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ctx.c
@@ -262,4 +262,34 @@ narrow_load("sockops", bpf_sock_ops, skb_hwtstamp);
 unaligned_access("flow_dissector", __sk_buff, data);
 unaligned_access("netfilter", bpf_nf_ctx, skb);
 
+#define padding_access(type, ctx, prev_field, sz)			\
+	SEC(type)							\
+	__description("access on " #ctx " padding after " #prev_field)	\
+	__naked void padding_ctx_access_##ctx(void)			\
+	{								\
+		asm volatile ("						\
+		r1 = *(u%[size] *)(r1 + %[off]);			\
+		r0 = 0;							\
+		exit;"							\
+		:							\
+		: __imm_const(size, sz * 8),				\
+		  __imm_const(off, offsetofend(struct ctx, prev_field))	\
+		: __clobber_all);					\
+	}
+
+__failure __msg("invalid bpf_context access")
+padding_access("cgroup/bind4", bpf_sock_addr, msg_src_ip6[3], 4);
+
+__success
+padding_access("sk_lookup", bpf_sk_lookup, remote_port, 2);
+
+__failure __msg("invalid bpf_context access")
+padding_access("tc", __sk_buff, tstamp_type, 2);
+
+__failure __msg("invalid bpf_context access")
+padding_access("cgroup/post_bind4", bpf_sock, dst_port, 2);
+
+__failure __msg("invalid bpf_context access")
+padding_access("sk_reuseport", sk_reuseport_md, hash, 4);
+
 char _license[] SEC("license") = "GPL";
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access
  2025-09-17  8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
                   ` (2 preceding siblings ...)
  2025-09-17  8:10 ` [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding Paul Chaignon
@ 2025-09-17 14:20 ` patchwork-bot+netdevbpf
  3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-09-17 14:20 UTC (permalink / raw)
  To: Paul Chaignon; +Cc: bpf, ast, daniel, andrii, martin.lau, eddyz87

Hello:

This series was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:

On Wed, 17 Sep 2025 10:07:08 +0200 you wrote:
> This patchset fixes bpf_sock_addr padding access to avoid a kernel
> warning and improves our selftests coverage for these ctx padding cases.
> 
> Changes in v2:
>   - Rebased on top of bpf-next.
>   - Added selftests for paddings in bpf_sock and sk_reuseport_md.
>   - Simplified sock_addr_is_valid_access's logic, as suggested by Daniel.
>   - Removed a tab copied from existing code and spotted by Eduard.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2,1/3] bpf: Explicitly check accesses to bpf_sock_addr
    https://git.kernel.org/bpf/bpf-next/c/6fabca2fc94d
  - [bpf-next,v2,2/3] selftests/bpf: Move macros to bpf_misc.h
    https://git.kernel.org/bpf/bpf-next/c/7c60f6e488b7
  - [bpf-next,v2,3/3] selftest/bpf: Test accesses to ctx padding
    https://git.kernel.org/bpf/bpf-next/c/180a46bc1a1c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2025-09-17 14:20 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-17  8:07 [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access Paul Chaignon
2025-09-17  8:08 ` [PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr Paul Chaignon
2025-09-17  8:09 ` [PATCH bpf-next v2 2/3] selftests/bpf: Move macros to bpf_misc.h Paul Chaignon
2025-09-17  8:10 ` [PATCH bpf-next v2 3/3] selftest/bpf: Test accesses to ctx padding Paul Chaignon
2025-09-17 14:20 ` [PATCH bpf-next v2 0/3] Avoid warning on bpf_sock_addr padding access patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox