[PATCH bpf-next v2 1/2] bpf, verifier: fold reg->var_off into PTR_TO_FLOW_KEYS bounds check

[PATCH bpf-next v2 1/2] bpf, verifier: fold reg->var_off into PTR_TO_FLOW_KEYS bounds check

[Nuoqi Gui]

Constant pointer arithmetic on a PTR_TO_FLOW_KEYS register lands the
constant in reg->var_off (e.g. flow_keys(imm=4096)), but the
PTR_TO_FLOW_KEYS path in check_mem_access() passes only insn->off to
check_flow_keys_access() and never folds reg->var_off.value.  The
verifier therefore accepts an access that, at runtime, dereferences past
struct bpf_flow_keys -- a verifier/runtime divergence that yields an
out-of-bounds read and write of kernel stack memory.

Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for
pointers") removed the generic "off += reg->off" that check_mem_access()
applied before the per-type dispatch and replaced it with per-path
folding of reg->var_off.value (for example the ctx path now folds the
register offset via check_ctx_access()).  The PTR_TO_FLOW_KEYS path was
not given the equivalent fold, so a constant offset that used to be
folded and rejected is now silently accepted:

  before 022ac0750883: the offset stays in reg->off and is folded
    generically, so the access is checked with off=4096 and rejected.
  after  022ac0750883: the offset lands in reg->var_off, the flow_keys
    path checks off=0 and accepts; at runtime the access dereferences
    base + 0x1000.

For a BPF_PROG_TYPE_FLOW_DISSECTOR program the following is accepted:

  r2 = *(u64 *)(r1 + 144)   ; R2=flow_keys (PTR_TO_FLOW_KEYS)
  r2 += 0x1000              ; R2=flow_keys(imm=4096), accepted
  r0 = *(u64 *)(r2 + 0)     ; accepted, var_off.value=0x1000 ignored

while the equivalent insn->off form

  r0 = *(u64 *)(r2 + 0x1000)

has the same effective offset but is correctly rejected with
"invalid access to flow keys off=4096 size=8", which isolates the defect
to the missing var_off fold.  Once attached as a flow dissector, the
accepted program reads kernel stack past struct bpf_flow_keys (a
kernel-stack / KASLR information leak) and can likewise write past it,
corrupting kernel memory.

Fix it by folding reg->var_off.value into the offset before the bounds
check and rejecting non-constant offsets, mirroring the other pointer
types (e.g. check_ctx_access()).

No released kernel is affected; the regression is confined to the 7.1
development cycle (reproduced on v7.1-rc1..rc5), and v7.0.x rejects the
program above.

Fixes: 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers")
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
---
 kernel/bpf/verifier.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8ed484cb1a8a..c04941636ef4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4728,9 +4728,22 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, struct b
 	return err;
 }
 
-static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
-				  int size)
+static int check_flow_keys_access(struct bpf_verifier_env *env, u32 regno,
+				  int off, int size)
 {
+	struct bpf_reg_state *reg = reg_state(env, regno);
+
+	/* Only a constant offset is allowed here; fold it into off. */
+	if (!tnum_is_const(reg->var_off)) {
+		char tn_buf[48];
+
+		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+		verbose(env, "R%d invalid variable offset to flow keys: off=%d, var_off=%s\n",
+			regno, off, tn_buf);
+		return -EACCES;
+	}
+	off += reg->var_off.value;
+
 	if (size < 0 || off < 0 ||
 	    (u64)off + size > sizeof(struct bpf_flow_keys)) {
 		verbose(env, "invalid access to flow keys off=%d size=%d\n",
@@ -6239,7 +6252,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
 			return -EACCES;
 		}
 
-		err = check_flow_keys_access(env, off, size);
+		err = check_flow_keys_access(env, regno, off, size);
 		if (!err && t == BPF_READ && value_regno >= 0)
 			mark_reg_unknown(env, regs, value_regno);
 	} else if (type_is_sk_pointer(reg->type)) {
-- 
2.34.1

[PATCH bpf-next v2 2/2] selftests/bpf: add tests for PTR_TO_FLOW_KEYS constant offset bounds

[Nuoqi Gui]

Add verifier tests covering constant pointer arithmetic on a
PTR_TO_FLOW_KEYS register, which regressed with commit 022ac0750883
("bpf: use reg->var_off instead of reg->off for pointers"): an
out-of-bounds offset introduced as flow_keys += K and then dereferenced
at insn->off 0 was accepted, while the equivalent flow_keys + K direct
offset was rejected.

The tests check that:
 - in-bounds constant arithmetic on the keys pointer is still accepted,
 - an out-of-bounds offset introduced via constant arithmetic is rejected
   for both read and write, with the same diagnostic as the direct
   insn->off form.

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
---
 .../selftests/bpf/prog_tests/verifier.c       |  2 +
 .../selftests/bpf/progs/verifier_flow_keys.c  | 77 +++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_flow_keys.c

diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index 219ff2969868..dae26dda3782 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -38,6 +38,7 @@
 #include "verifier_div0.skel.h"
 #include "verifier_div_mod_bounds.skel.h"
 #include "verifier_div_overflow.skel.h"
+#include "verifier_flow_keys.skel.h"
 #include "verifier_global_subprogs.skel.h"
 #include "verifier_global_ptr_args.skel.h"
 #include "verifier_gotol.skel.h"
@@ -189,6 +190,7 @@ void test_verifier_direct_stack_access_wraparound(void) { RUN(verifier_direct_st
 void test_verifier_div0(void)                 { RUN(verifier_div0); }
 void test_verifier_div_mod_bounds(void)       { RUN(verifier_div_mod_bounds); }
 void test_verifier_div_overflow(void)         { RUN(verifier_div_overflow); }
+void test_verifier_flow_keys(void)            { RUN(verifier_flow_keys); }
 void test_verifier_global_subprogs(void)      { RUN(verifier_global_subprogs); }
 void test_verifier_global_ptr_args(void)      { RUN(verifier_global_ptr_args); }
 void test_verifier_gotol(void)                { RUN(verifier_gotol); }
diff --git a/tools/testing/selftests/bpf/progs/verifier_flow_keys.c b/tools/testing/selftests/bpf/progs/verifier_flow_keys.c
new file mode 100644
index 000000000000..512e5d1d2665
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_flow_keys.c
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Constant-offset bounds checks for PTR_TO_FLOW_KEYS pointer arithmetic. */
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+/* sizeof(struct bpf_flow_keys) is well under 4096, so +0x1000 is OOB. */
+
+SEC("flow_dissector")
+__description("flow_keys: in-bounds constant pointer arithmetic accepted")
+__success
+__naked void flow_keys_const_inbounds(void)
+{
+	asm volatile ("					\
+	r1 = *(u64 *)(r1 + %[flow_keys]);		\
+	r1 += 8;					\
+	r0 = *(u64 *)(r1 + 0);				\
+	r0 = 0;						\
+	exit;						\
+"	:
+	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
+	: __clobber_all);
+}
+
+SEC("flow_dissector")
+__description("flow_keys: OOB via constant pointer arithmetic rejected")
+__failure __msg("invalid access to flow keys off=4096 size=8")
+__naked void flow_keys_const_oob_read(void)
+{
+	asm volatile ("					\
+	r1 = *(u64 *)(r1 + %[flow_keys]);		\
+	r1 += 4096;					\
+	r0 = *(u64 *)(r1 + 0);				\
+	r0 = 0;						\
+	exit;						\
+"	:
+	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
+	: __clobber_all);
+}
+
+SEC("flow_dissector")
+__description("flow_keys: OOB write via constant pointer arithmetic rejected")
+__failure __msg("invalid access to flow keys off=4096 size=8")
+__naked void flow_keys_const_oob_write(void)
+{
+	asm volatile ("					\
+	r1 = *(u64 *)(r1 + %[flow_keys]);		\
+	r1 += 4096;					\
+	r2 = 0;						\
+	*(u64 *)(r1 + 0) = r2;				\
+	r0 = 0;						\
+	exit;						\
+"	:
+	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
+	: __clobber_all);
+}
+
+/* Equivalent OOB expressed directly in insn->off; this form was always
+ * rejected and is kept to show both forms now share one diagnostic.
+ */
+SEC("flow_dissector")
+__description("flow_keys: OOB via insn->off rejected")
+__failure __msg("invalid access to flow keys off=4096 size=8")
+__naked void flow_keys_insn_off_oob(void)
+{
+	asm volatile ("					\
+	r1 = *(u64 *)(r1 + %[flow_keys]);		\
+	r0 = *(u64 *)(r1 + 4096);			\
+	r0 = 0;						\
+	exit;						\
+"	:
+	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
+	: __clobber_all);
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.34.1

Re: [PATCH bpf-next v2 2/2] selftests/bpf: add tests for PTR_TO_FLOW_KEYS constant offset bounds

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1428 bytes --]

>     selftests/bpf: add tests for PTR_TO_FLOW_KEYS constant offset bounds
>
>     Add verifier tests covering constant pointer arithmetic on a
>     PTR_TO_FLOW_KEYS register, which regressed with commit 022ac0750883
>     ("bpf: use reg->var_off instead of reg->off for pointers"): an
>     out-of-bounds offset introduced as flow_keys += K and then dereferenced
>     at insn->off 0 was accepted, while the equivalent flow_keys + K direct
>     offset was rejected.
>
>     The tests check that:
>      - in-bounds constant arithmetic on the keys pointer is still accepted,
>      - an out-of-bounds offset introduced via constant arithmetic is rejected
>        for both read and write, with the same diagnostic as the direct
>        insn->off form.
>
>     Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>

The commit message names the commit that introduced the out-of-bounds
behaviour these tests reproduce, but there is no Fixes: tag.

Should this carry a Fixes: tag so it is backported alongside the
functional fix?

  Fixes: 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers")

The accompanying fix commit (89ea48e0ec4c) already carries the same tag.

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/26970818032

Re: [PATCH bpf-next v2 1/2] bpf, verifier: fold reg->var_off into PTR_TO_FLOW_KEYS bounds check

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2871 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8ed484cb1a8a..c04941636ef4 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4728,9 +4728,22 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, struct b
>  	return err;
>  }
>
> -static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
> -				  int size)
> +static int check_flow_keys_access(struct bpf_verifier_env *env, u32 regno,
> +				  int off, int size)
>  {
> +	struct bpf_reg_state *reg = reg_state(env, regno);
> +
> +	/* Only a constant offset is allowed here; fold it into off. */
> +	if (!tnum_is_const(reg->var_off)) {
> +		char tn_buf[48];
> +
> +		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
> +		verbose(env, "R%d invalid variable offset to flow keys: off=%d, var_off=%s\n",
> +			regno, off, tn_buf);
> +		return -EACCES;
> +	}
> +	off += reg->var_off.value;
> +
>  	if (size < 0 || off < 0 ||
>  	    (u64)off + size > sizeof(struct bpf_flow_keys)) {
>  		verbose(env, "invalid access to flow keys off=%d size=%d\n",
> @@ -6239,7 +6252,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
>  			return -EACCES;
>  		}
>
> -		err = check_flow_keys_access(env, off, size);
> +		err = check_flow_keys_access(env, regno, off, size);
                                                       ^^^^^

Does this code compile? Looking at check_mem_access(), the function signature
is:

static int check_mem_access(struct bpf_verifier_env *env, int insn_idx,
                           struct bpf_reg_state *reg, argno_t argno,
                           int off, int bpf_size, enum bpf_access_type t,
                           int value_regno, bool strict_alignment_once,
                           bool is_ldsx)

There is no 'regno' parameter or local variable. The register information is
passed as 'argno_t argno' and 'struct bpf_reg_state *reg'.

The established pattern in this file for obtaining a register number from an
argno_t is reg_from_argno(argno), used throughout verifier.c. For example:

verifier.c:1791:
    u32 regno = reg_from_argno(argno);

verifier.c:6859:
    regno = reg_from_argno(argno);

The call should be:

    err = check_flow_keys_access(env, reg_from_argno(argno), off, size);

This matches check_flow_keys_access()'s new signature where it does
reg_state(env, regno) to look up the register state, which should equal the
'reg' parameter already held by check_mem_access.

>  		if (!err && t == BPF_READ && value_regno >= 0)
>  			mark_reg_unknown(env, regs, value_regno);
>  	} else if (type_is_sk_pointer(reg->type)) {


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/26970818032

Re: [PATCH bpf-next v2 1/2] bpf, verifier: fold reg->var_off into PTR_TO_FLOW_KEYS bounds check

[Eduard Zingerman]

On Fri, 2026-06-05 at 02:07 +0800, Nuoqi Gui wrote:
> Constant pointer arithmetic on a PTR_TO_FLOW_KEYS register lands the
> constant in reg->var_off (e.g. flow_keys(imm=4096)), but the
> PTR_TO_FLOW_KEYS path in check_mem_access() passes only insn->off to
> check_flow_keys_access() and never folds reg->var_off.value.  The
> verifier therefore accepts an access that, at runtime, dereferences past
> struct bpf_flow_keys -- a verifier/runtime divergence that yields an
> out-of-bounds read and write of kernel stack memory.
> 
> Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for
> pointers") removed the generic "off += reg->off" that check_mem_access()
> applied before the per-type dispatch and replaced it with per-path
> folding of reg->var_off.value (for example the ctx path now folds the
> register offset via check_ctx_access()).  The PTR_TO_FLOW_KEYS path was
> not given the equivalent fold, so a constant offset that used to be
> folded and rejected is now silently accepted:
> 
>   before 022ac0750883: the offset stays in reg->off and is folded
>     generically, so the access is checked with off=4096 and rejected.
>   after  022ac0750883: the offset lands in reg->var_off, the flow_keys
>     path checks off=0 and accepts; at runtime the access dereferences
>     base + 0x1000.
> 
> For a BPF_PROG_TYPE_FLOW_DISSECTOR program the following is accepted:
> 
>   r2 = *(u64 *)(r1 + 144)   ; R2=flow_keys (PTR_TO_FLOW_KEYS)
>   r2 += 0x1000              ; R2=flow_keys(imm=4096), accepted
>   r0 = *(u64 *)(r2 + 0)     ; accepted, var_off.value=0x1000 ignored
> 
> while the equivalent insn->off form
> 
>   r0 = *(u64 *)(r2 + 0x1000)
> 
> has the same effective offset but is correctly rejected with
> "invalid access to flow keys off=4096 size=8", which isolates the defect
> to the missing var_off fold.  Once attached as a flow dissector, the
> accepted program reads kernel stack past struct bpf_flow_keys (a
> kernel-stack / KASLR information leak) and can likewise write past it,
> corrupting kernel memory.
> 
> Fix it by folding reg->var_off.value into the offset before the bounds
> check and rejecting non-constant offsets, mirroring the other pointer
> types (e.g. check_ctx_access()).
> 
> No released kernel is affected; the regression is confined to the 7.1
> development cycle (reproduced on v7.1-rc1..rc5), and v7.0.x rejects the
> program above.
> 
> Fixes: 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers")
> Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> ---

This fixes a real issue, thank you for finding it.

>  kernel/bpf/verifier.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8ed484cb1a8a..c04941636ef4 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4728,9 +4728,22 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, struct b
>  	return err;
>  }
>  
> -static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
> -				  int size)
> +static int check_flow_keys_access(struct bpf_verifier_env *env, u32 regno,
> +				  int off, int size)
>  {
> +	struct bpf_reg_state *reg = reg_state(env, regno);
> +
> +	/* Only a constant offset is allowed here; fold it into off. */
> +	if (!tnum_is_const(reg->var_off)) {
> +		char tn_buf[48];
> +
> +		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
> +		verbose(env, "R%d invalid variable offset to flow keys: off=%d, var_off=%s\n",
> +			regno, off, tn_buf);
> +		return -EACCES;
> +	}
> +	off += reg->var_off.value;
> +
>  	if (size < 0 || off < 0 ||
>  	    (u64)off + size > sizeof(struct bpf_flow_keys)) {
>  		verbose(env, "invalid access to flow keys off=%d size=%d\n",
> @@ -6239,7 +6252,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
>  			return -EACCES;
>  		}
>  
> -		err = check_flow_keys_access(env, off, size);
> +		err = check_flow_keys_access(env, regno, off, size);
                                                  ^^^^^
This variable is not defined, hence this patch leads to the compilation error.

>  		if (!err && t == BPF_READ && value_regno >= 0)
>  			mark_reg_unknown(env, regs, value_regno);
>  	} else if (type_is_sk_pointer(reg->type)) {

Re: [PATCH bpf-next v2 2/2] selftests/bpf: add tests for PTR_TO_FLOW_KEYS constant offset bounds

[Eduard Zingerman]

On Fri, 2026-06-05 at 02:07 +0800, Nuoqi Gui wrote:
> Add verifier tests covering constant pointer arithmetic on a
> PTR_TO_FLOW_KEYS register, which regressed with commit 022ac0750883
> ("bpf: use reg->var_off instead of reg->off for pointers"): an
> out-of-bounds offset introduced as flow_keys += K and then dereferenced
> at insn->off 0 was accepted, while the equivalent flow_keys + K direct
> offset was rejected.
> 
> The tests check that:
>  - in-bounds constant arithmetic on the keys pointer is still accepted,
>  - an out-of-bounds offset introduced via constant arithmetic is rejected
>    for both read and write, with the same diagnostic as the direct
>    insn->off form.
> 
> Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> ---
>  .../selftests/bpf/prog_tests/verifier.c       |  2 +
>  .../selftests/bpf/progs/verifier_flow_keys.c  | 77 +++++++++++++++++++
>  2 files changed, 79 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/progs/verifier_flow_keys.c
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
> index 219ff2969868..dae26dda3782 100644
> --- a/tools/testing/selftests/bpf/prog_tests/verifier.c
> +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
> @@ -38,6 +38,7 @@
>  #include "verifier_div0.skel.h"
>  #include "verifier_div_mod_bounds.skel.h"
>  #include "verifier_div_overflow.skel.h"
> +#include "verifier_flow_keys.skel.h"
>  #include "verifier_global_subprogs.skel.h"
>  #include "verifier_global_ptr_args.skel.h"
>  #include "verifier_gotol.skel.h"
> @@ -189,6 +190,7 @@ void test_verifier_direct_stack_access_wraparound(void) { RUN(verifier_direct_st
>  void test_verifier_div0(void)                 { RUN(verifier_div0); }
>  void test_verifier_div_mod_bounds(void)       { RUN(verifier_div_mod_bounds); }
>  void test_verifier_div_overflow(void)         { RUN(verifier_div_overflow); }
> +void test_verifier_flow_keys(void)            { RUN(verifier_flow_keys); }
>  void test_verifier_global_subprogs(void)      { RUN(verifier_global_subprogs); }
>  void test_verifier_global_ptr_args(void)      { RUN(verifier_global_ptr_args); }
>  void test_verifier_gotol(void)                { RUN(verifier_gotol); }
> diff --git a/tools/testing/selftests/bpf/progs/verifier_flow_keys.c b/tools/testing/selftests/bpf/progs/verifier_flow_keys.c
> new file mode 100644
> index 000000000000..512e5d1d2665
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_flow_keys.c
> @@ -0,0 +1,77 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Constant-offset bounds checks for PTR_TO_FLOW_KEYS pointer arithmetic. */
> +
> +#include "vmlinux.h"
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +/* sizeof(struct bpf_flow_keys) is well under 4096, so +0x1000 is OOB. */
> +
> +SEC("flow_dissector")
> +__description("flow_keys: in-bounds constant pointer arithmetic accepted")
> +__success
> +__naked void flow_keys_const_inbounds(void)
> +{
> +	asm volatile ("					\
> +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> +	r1 += 8;					\
> +	r0 = *(u64 *)(r1 + 0);				\
> +	r0 = 0;						\
> +	exit;						\
> +"	:
> +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> +	: __clobber_all);
> +}
> +
> +SEC("flow_dissector")
> +__description("flow_keys: OOB via constant pointer arithmetic rejected")
> +__failure __msg("invalid access to flow keys off=4096 size=8")
> +__naked void flow_keys_const_oob_read(void)
> +{
> +	asm volatile ("					\
> +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> +	r1 += 4096;					\
> +	r0 = *(u64 *)(r1 + 0);				\
> +	r0 = 0;						\
> +	exit;						\
> +"	:
> +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> +	: __clobber_all);
> +}
> +
> +SEC("flow_dissector")
> +__description("flow_keys: OOB write via constant pointer arithmetic rejected")
> +__failure __msg("invalid access to flow keys off=4096 size=8")
> +__naked void flow_keys_const_oob_write(void)
> +{
> +	asm volatile ("					\
> +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> +	r1 += 4096;					\
> +	r2 = 0;						\
> +	*(u64 *)(r1 + 0) = r2;				\
> +	r0 = 0;						\
> +	exit;						\
> +"	:
> +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> +	: __clobber_all);
> +}
> +
> +/* Equivalent OOB expressed directly in insn->off; this form was always
> + * rejected and is kept to show both forms now share one diagnostic.
> + */
> +SEC("flow_dissector")
> +__description("flow_keys: OOB via insn->off rejected")
> +__failure __msg("invalid access to flow keys off=4096 size=8")
> +__naked void flow_keys_insn_off_oob(void)
> +{
> +	asm volatile ("					\
> +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> +	r0 = *(u64 *)(r1 + 4096);			\
> +	r0 = 0;						\
> +	exit;						\
> +"	:
> +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> +	: __clobber_all);
> +}
> +
> +char _license[] SEC("license") = "GPL";

Could you please also add a test with a truly varying offset?
Like below:

__naked void flow_keys_var_read(void)
{
	asm volatile ("					\
	r6 = r1;					\
	call %[bpf_get_prandom_u32];			\
	r0 &= 0xFFFF;					\
	r1 = *(u64 *)(r6 + %[flow_keys]);		\
	r1 += r0;					\
	r0 = *(u64 *)(r1 + 0);				\
	r0 = 0;						\
	exit;						\
"	:
	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys)),
	  __imm(bpf_get_prandom_u32)
	: __clobber_all);
}

Re: Re: [PATCH bpf-next v2 1/2] bpf, verifier: fold reg->var_off into PTR_TO_FLOW_KEYS bounds check

[gnq25]

Thanks for catching this. This is my mistake.

The original change was prepared against the bpf tree. After moving it to
bpf-next, I adjusted the patch mechanically but did not properly rebuild
and rerun the tests on bpf-next. The verifier code around this path is
different between the two trees, and the variable used in the bpf version
is not available in the bpf-next context.

I will fix the bpf-next version, rebuild it, and rerun the relevant
selftests.

(Resending to the list — my earlier reply was accidentally sent off-list 
because I didn't reply-all. Apologies for the duplicate.)

> -----Original Messages-----
> From: "Eduard Zingerman" <eddyz87@gmail.com>
> Send time:Friday, 05/06/2026 10:22:03
> To: "Nuoqi Gui" <gnq25@mails.tsinghua.edu.cn>, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org
> Cc: "John Fastabend" <john.fastabend@gmail.com>, "Martin KaFai Lau" <martin.lau@linux.dev>, "Kumar Kartikeya Dwivedi" <memxor@gmail.com>, "Song
>  Liu" <song@kernel.org>, "Yonghong Song" <yonghong.song@linux.dev>, "Jiri Olsa" <jolsa@kernel.org>, bpf@vger.kernel.org, linux-kernel@vger.kernel.org
> Subject: Re: [PATCH bpf-next v2 1/2] bpf, verifier: fold reg->var_off into PTR_TO_FLOW_KEYS bounds check
> 
> On Fri, 2026-06-05 at 02:07 +0800, Nuoqi Gui wrote:
> > Constant pointer arithmetic on a PTR_TO_FLOW_KEYS register lands the
> > constant in reg->var_off (e.g. flow_keys(imm=4096)), but the
> > PTR_TO_FLOW_KEYS path in check_mem_access() passes only insn->off to
> > check_flow_keys_access() and never folds reg->var_off.value.  The
> > verifier therefore accepts an access that, at runtime, dereferences past
> > struct bpf_flow_keys -- a verifier/runtime divergence that yields an
> > out-of-bounds read and write of kernel stack memory.
> > 
> > Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for
> > pointers") removed the generic "off += reg->off" that check_mem_access()
> > applied before the per-type dispatch and replaced it with per-path
> > folding of reg->var_off.value (for example the ctx path now folds the
> > register offset via check_ctx_access()).  The PTR_TO_FLOW_KEYS path was
> > not given the equivalent fold, so a constant offset that used to be
> > folded and rejected is now silently accepted:
> > 
> >   before 022ac0750883: the offset stays in reg->off and is folded
> >     generically, so the access is checked with off=4096 and rejected.
> >   after  022ac0750883: the offset lands in reg->var_off, the flow_keys
> >     path checks off=0 and accepts; at runtime the access dereferences
> >     base + 0x1000.
> > 
> > For a BPF_PROG_TYPE_FLOW_DISSECTOR program the following is accepted:
> > 
> >   r2 = *(u64 *)(r1 + 144)   ; R2=flow_keys (PTR_TO_FLOW_KEYS)
> >   r2 += 0x1000              ; R2=flow_keys(imm=4096), accepted
> >   r0 = *(u64 *)(r2 + 0)     ; accepted, var_off.value=0x1000 ignored
> > 
> > while the equivalent insn->off form
> > 
> >   r0 = *(u64 *)(r2 + 0x1000)
> > 
> > has the same effective offset but is correctly rejected with
> > "invalid access to flow keys off=4096 size=8", which isolates the defect
> > to the missing var_off fold.  Once attached as a flow dissector, the
> > accepted program reads kernel stack past struct bpf_flow_keys (a
> > kernel-stack / KASLR information leak) and can likewise write past it,
> > corrupting kernel memory.
> > 
> > Fix it by folding reg->var_off.value into the offset before the bounds
> > check and rejecting non-constant offsets, mirroring the other pointer
> > types (e.g. check_ctx_access()).
> > 
> > No released kernel is affected; the regression is confined to the 7.1
> > development cycle (reproduced on v7.1-rc1..rc5), and v7.0.x rejects the
> > program above.
> > 
> > Fixes: 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers")
> > Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> > ---
> 
> This fixes a real issue, thank you for finding it.
> 
> >  kernel/bpf/verifier.c | 19 ++++++++++++++++---
> >  1 file changed, 16 insertions(+), 3 deletions(-)
> > 
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 8ed484cb1a8a..c04941636ef4 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -4728,9 +4728,22 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, struct b
> >  	return err;
> >  }
> >  
> > -static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
> > -				  int size)
> > +static int check_flow_keys_access(struct bpf_verifier_env *env, u32 regno,
> > +				  int off, int size)
> >  {
> > +	struct bpf_reg_state *reg = reg_state(env, regno);
> > +
> > +	/* Only a constant offset is allowed here; fold it into off. */
> > +	if (!tnum_is_const(reg->var_off)) {
> > +		char tn_buf[48];
> > +
> > +		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
> > +		verbose(env, "R%d invalid variable offset to flow keys: off=%d, var_off=%s\n",
> > +			regno, off, tn_buf);
> > +		return -EACCES;
> > +	}
> > +	off += reg->var_off.value;
> > +
> >  	if (size < 0 || off < 0 ||
> >  	    (u64)off + size > sizeof(struct bpf_flow_keys)) {
> >  		verbose(env, "invalid access to flow keys off=%d size=%d\n",
> > @@ -6239,7 +6252,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
> >  			return -EACCES;
> >  		}
> >  
> > -		err = check_flow_keys_access(env, off, size);
> > +		err = check_flow_keys_access(env, regno, off, size);
>                                                   ^^^^^
> This variable is not defined, hence this patch leads to the compilation error.
> 
> >  		if (!err && t == BPF_READ && value_regno >= 0)
> >  			mark_reg_unknown(env, regs, value_regno);
> >  	} else if (type_is_sk_pointer(reg->type)) {

Re: Re: [PATCH bpf-next v2 2/2] selftests/bpf: add tests for PTR_TO_FLOW_KEYS constant offset bounds

[gnq25]

Yes, I will add a selftest with a truly varying offset, 
as suggested. I will include this in the next version.


> -----Original Messages-----
> From: "Eduard Zingerman" <eddyz87@gmail.com>
> Send time:Friday, 05/06/2026 10:23:41
> To: "Nuoqi Gui" <gnq25@mails.tsinghua.edu.cn>, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org
> Cc: "Martin KaFai Lau" <martin.lau@linux.dev>, "Kumar Kartikeya Dwivedi" <memxor@gmail.com>, "Song Liu" <song@kernel.org>, "Yonghong Song" <yonghong.song@linux.dev>, "Jiri Olsa" <jolsa@kernel.org>, "Shuah Khan" <shuah@kernel.org>, "Shenghao Yuan" <shenghaoyuan0928@163.com>, "Yazhou Tang" <tangyazhou518@outlook.com>, "Matt Bobrowski" <mattbobrowski@google.com>, "Emil Tsalapatis" <emil@etsalapatis.com>, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org
> Subject: Re: [PATCH bpf-next v2 2/2] selftests/bpf: add tests for PTR_TO_FLOW_KEYS constant offset bounds
> 
> On Fri, 2026-06-05 at 02:07 +0800, Nuoqi Gui wrote:
> > Add verifier tests covering constant pointer arithmetic on a
> > PTR_TO_FLOW_KEYS register, which regressed with commit 022ac0750883
> > ("bpf: use reg->var_off instead of reg->off for pointers"): an
> > out-of-bounds offset introduced as flow_keys += K and then dereferenced
> > at insn->off 0 was accepted, while the equivalent flow_keys + K direct
> > offset was rejected.
> > 
> > The tests check that:
> >  - in-bounds constant arithmetic on the keys pointer is still accepted,
> >  - an out-of-bounds offset introduced via constant arithmetic is rejected
> >    for both read and write, with the same diagnostic as the direct
> >    insn->off form.
> > 
> > Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> > ---
> >  .../selftests/bpf/prog_tests/verifier.c       |  2 +
> >  .../selftests/bpf/progs/verifier_flow_keys.c  | 77 +++++++++++++++++++
> >  2 files changed, 79 insertions(+)
> >  create mode 100644 tools/testing/selftests/bpf/progs/verifier_flow_keys.c
> > 
> > diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
> > index 219ff2969868..dae26dda3782 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/verifier.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
> > @@ -38,6 +38,7 @@
> >  #include "verifier_div0.skel.h"
> >  #include "verifier_div_mod_bounds.skel.h"
> >  #include "verifier_div_overflow.skel.h"
> > +#include "verifier_flow_keys.skel.h"
> >  #include "verifier_global_subprogs.skel.h"
> >  #include "verifier_global_ptr_args.skel.h"
> >  #include "verifier_gotol.skel.h"
> > @@ -189,6 +190,7 @@ void test_verifier_direct_stack_access_wraparound(void) { RUN(verifier_direct_st
> >  void test_verifier_div0(void)                 { RUN(verifier_div0); }
> >  void test_verifier_div_mod_bounds(void)       { RUN(verifier_div_mod_bounds); }
> >  void test_verifier_div_overflow(void)         { RUN(verifier_div_overflow); }
> > +void test_verifier_flow_keys(void)            { RUN(verifier_flow_keys); }
> >  void test_verifier_global_subprogs(void)      { RUN(verifier_global_subprogs); }
> >  void test_verifier_global_ptr_args(void)      { RUN(verifier_global_ptr_args); }
> >  void test_verifier_gotol(void)                { RUN(verifier_gotol); }
> > diff --git a/tools/testing/selftests/bpf/progs/verifier_flow_keys.c b/tools/testing/selftests/bpf/progs/verifier_flow_keys.c
> > new file mode 100644
> > index 000000000000..512e5d1d2665
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/progs/verifier_flow_keys.c
> > @@ -0,0 +1,77 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/* Constant-offset bounds checks for PTR_TO_FLOW_KEYS pointer arithmetic. */
> > +
> > +#include "vmlinux.h"
> > +#include <bpf/bpf_helpers.h>
> > +#include "bpf_misc.h"
> > +
> > +/* sizeof(struct bpf_flow_keys) is well under 4096, so +0x1000 is OOB. */
> > +
> > +SEC("flow_dissector")
> > +__description("flow_keys: in-bounds constant pointer arithmetic accepted")
> > +__success
> > +__naked void flow_keys_const_inbounds(void)
> > +{
> > +	asm volatile ("					\
> > +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> > +	r1 += 8;					\
> > +	r0 = *(u64 *)(r1 + 0);				\
> > +	r0 = 0;						\
> > +	exit;						\
> > +"	:
> > +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> > +	: __clobber_all);
> > +}
> > +
> > +SEC("flow_dissector")
> > +__description("flow_keys: OOB via constant pointer arithmetic rejected")
> > +__failure __msg("invalid access to flow keys off=4096 size=8")
> > +__naked void flow_keys_const_oob_read(void)
> > +{
> > +	asm volatile ("					\
> > +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> > +	r1 += 4096;					\
> > +	r0 = *(u64 *)(r1 + 0);				\
> > +	r0 = 0;						\
> > +	exit;						\
> > +"	:
> > +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> > +	: __clobber_all);
> > +}
> > +
> > +SEC("flow_dissector")
> > +__description("flow_keys: OOB write via constant pointer arithmetic rejected")
> > +__failure __msg("invalid access to flow keys off=4096 size=8")
> > +__naked void flow_keys_const_oob_write(void)
> > +{
> > +	asm volatile ("					\
> > +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> > +	r1 += 4096;					\
> > +	r2 = 0;						\
> > +	*(u64 *)(r1 + 0) = r2;				\
> > +	r0 = 0;						\
> > +	exit;						\
> > +"	:
> > +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> > +	: __clobber_all);
> > +}
> > +
> > +/* Equivalent OOB expressed directly in insn->off; this form was always
> > + * rejected and is kept to show both forms now share one diagnostic.
> > + */
> > +SEC("flow_dissector")
> > +__description("flow_keys: OOB via insn->off rejected")
> > +__failure __msg("invalid access to flow keys off=4096 size=8")
> > +__naked void flow_keys_insn_off_oob(void)
> > +{
> > +	asm volatile ("					\
> > +	r1 = *(u64 *)(r1 + %[flow_keys]);		\
> > +	r0 = *(u64 *)(r1 + 4096);			\
> > +	r0 = 0;						\
> > +	exit;						\
> > +"	:
> > +	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
> > +	: __clobber_all);
> > +}
> > +
> > +char _license[] SEC("license") = "GPL";
> 
> Could you please also add a test with a truly varying offset?
> Like below:
> 
> __naked void flow_keys_var_read(void)
> {
> 	asm volatile ("					\
> 	r6 = r1;					\
> 	call %[bpf_get_prandom_u32];			\
> 	r0 &= 0xFFFF;					\
> 	r1 = *(u64 *)(r6 + %[flow_keys]);		\
> 	r1 += r0;					\
> 	r0 = *(u64 *)(r1 + 0);				\
> 	r0 = 0;						\
> 	exit;						\
> "	:
> 	: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys)),
> 	  __imm(bpf_get_prandom_u32)
> 	: __clobber_all);
> }