Skip to content

Linux 6.18.y non existent field rejected #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shunghsiyu wants to merge 2 commits into
base: linux-6.18.y
Choose a base branch
from
Open

Linux 6.18.y non existent field rejected #13

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
08e878a
selftests/bpf: Adjust verifier_map_ptr for the map's excl field
sinkap Jun 1, 2026
38ce453
selftests/bpf: Keep verifier_map_ptr exercising ops pointer access
borkmann Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 32 additions & 4 deletions tools/testing/selftests/bpf/progs/verifier_map_ptr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,17 +70,45 @@ __naked void bpf_map_ptr_write_rejected(void)
: __clobber_all);
}

/* The first element of struct bpf_map is a SHA256 hash of 32 bytes, accessing
* into this array is valid. The opts field is now at offset 33.
/*
* struct bpf_map starts with the SHA256 hash sha[32] at offset 0 (a readable
* byte array), the u32 excl field at offset 32, and the ops pointer at offset
* 40. Reading a u32 at offset 41 reaches into the middle of the ops pointer,
* i.e. a partial pointer access, which is rejected.
*/
SEC("socket")
__description("bpf_map_ptr: read non-existent field rejected")
__failure
__msg("cannot access ptr member ops with moff 32 in struct bpf_map with off 33 size 4")
__msg("cannot access ptr member ops with moff 40 in struct bpf_map with off 41 size 4")
__failure_unpriv
__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
__flag(BPF_F_ANY_ALIGNMENT)
__naked void read_non_existent_field_rejected(void)
{
asm volatile (" \
r6 = 0; \
r1 = %[map_array_48b] ll; \
r6 = *(u32*)(r1 + 41); \
r0 = 1; \
exit; \
" :
: __imm_addr(map_array_48b)
: __clobber_all);
}

/*
* The u32 excl field spans offsets 32..35 (mend 36). Reading a u32 at offset
* 33 starts inside excl but extends past its end, which the verifier rejects
* as an out-of-bounds scalar access.
*/
SEC("socket")
__description("bpf_map_ptr: read beyond excl field rejected")
__failure
__msg("access beyond the end of member excl (mend:36) in struct bpf_map with off 33 size 4")
__failure_unpriv
__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
__flag(BPF_F_ANY_ALIGNMENT)
__naked void read_beyond_excl_field_rejected(void)
{
asm volatile (" \
r6 = 0; \
Expand All @@ -103,7 +131,7 @@ __naked void ptr_read_ops_field_accepted(void)
asm volatile (" \
r6 = 0; \
r1 = %[map_array_48b] ll; \
r6 = *(u64*)(r1 + 0); \
r6 = *(u64*)(r1 + 40); \
r0 = 1; \
exit; \
" :
Expand Down
Loading