Re: [PATCH] bpf: fix verifier model mismatch on __sk_buff.remote_port narrow read

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu,  5 Nov 2026 14:03:31 +0800 you wrote:
> On little endian, the ctx access conversion for __sk_buff.remote_port
> loads the 16-bit skc_dport and shifts it left by 16, producing a
> 4-byte value of up to 0xffff0000.  It reports its width through
> bpf_target_off() as 2, the member size.
> 
> A 2-byte read is a narrower load of this 4-byte ctx field, but the
> fixup pass only masks the result when the access size is smaller
> than the reported width, so the masking is skipped.  The verifier
> models the register as [0, 0xffff] while the runtime value is
> [0, 0xffff0000].  Arithmetic the verifier folds to a constant can
> therefore take any 16-bit port value at runtime, enabling
> out-of-bounds reads and writes relative to map values.
> 
> [...]

Here is the summary with links:
  - bpf: fix verifier model mismatch on __sk_buff.remote_port narrow read
    https://git.kernel.org/bpf/bpf/c/4722bac72de6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html