Paul Chaignon 6557f1565d bpf: Fix bpf_xdp_store_bytes proto for read-only arg ... While making some maps in Cilium read-only from the BPF side, we noticed that the bpf_xdp_store_bytes proto is incorrect. In particular, the verifier was throwing the following error: ; ret = ctx_store_bytes(ctx, l3_off + offsetof(struct iphdr, saddr), &nat->address, 4, 0); 635: (79) r1 = *(u64 *)(r10 -144) ; R1=ctx() R10=fp0 fp-144=ctx() 636: (b4) w2 = 26 ; R2=26 637: (b4) w4 = 4 ; R4=4 638: (b4) w5 = 0 ; R5=0 639: (85) call bpf_xdp_store_bytes#190 write into map forbidden, value_size=6 off=0 size=4 nat comes from a BPF_F_RDONLY_PROG map, so R3 is a PTR_TO_MAP_VALUE. The verifier checks the helper's memory access to R3 in check_mem_size_reg, as it reaches ARG_CONST_SIZE argument. The third argument has expected type ARG_PTR_TO_UNINIT_MEM, which includes the MEM_WRITE flag. The verifier thus checks for a BPF_WRITE access on R3. Given R3 points to a read-only map, the check fails. Conversely, ARG_PTR_TO_UNINIT_MEM can also lead to the helper reading from uninitialized memory. This patch simply fixes the expected argument type to match that of bpf_skb_store_bytes. Fixes: 3f364222d0 ("net: xdp: introduce bpf_xdp_pointer utility routine") Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/9fa3c9f72d806e82541071c4df88b8cba28ad6a9.1769875479.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2026-01-31 13:49:43 -08:00
..
bpf_sk_storage.c	bpf: add fsession support	2026-01-24 18:49:35 -08:00
datagram.c	net: datagram: introduce datagram_poll_queue for custom receive queues	2025-10-23 15:46:04 +02:00
dev_addr_lists_test.c	net: dev_addr_lists: move locking out of init/exit in kunit	2024-04-15 10:26:35 +01:00
dev_addr_lists.c	net: s/dev_pre_changeaddr_notify/netif_pre_changeaddr_notify/	2025-07-18 17:27:47 -07:00
dev_api.c	net: define an enum for the napi threaded state	2025-07-24 18:34:55 -07:00
dev_ioctl.c	phy: add hwtstamp_get callback to phy drivers	2025-11-26 16:56:33 -08:00
dev.c	net: avoid prefetching NULL pointers	2025-12-28 10:19:11 +01:00
dev.h	for-6.19/io_uring-20251201	2025-12-03 18:58:57 -08:00
devmem.c	netmem, devmem, tcp: access pp fields through @desc in net_iov	2025-11-27 17:41:51 -08:00
devmem.h	net: devmem: Remove unused declaration net_devmem_bind_tx_release()	2025-11-04 17:29:19 -08:00
drop_monitor.c	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
dst_cache.c	net: dst: annotate data-races around dst->obsolete	2025-07-02 14:32:29 -07:00
dst.c	net: dst: introduce dst->dev_rcu	2025-08-29 19:36:31 -07:00
failover.c	net: failover: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf	2022-12-12 15:18:25 -08:00
fib_notifier.c	net: do not acquire rtnl in fib_seq_sum()	2024-10-11 15:35:05 -07:00
fib_rules.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-04-17 12:26:50 -07:00
filter.c	bpf: Fix bpf_xdp_store_bytes proto for read-only arg	2026-01-31 13:49:43 -08:00
flow_dissector.c	net: remove '__' from __skb_flow_get_ports()	2025-02-24 14:27:53 -08:00
flow_offload.c	tc: flower: Enable offload support IPSEC SPI field.	2023-08-02 10:09:32 +01:00
gen_estimator.c	net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y	2025-08-29 19:04:20 -07:00
gen_stats.c	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
gro_cells.c	net: gro_cells: Reduce lock scope in gro_cell_poll	2025-11-05 17:41:29 -08:00
gro.c	net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()	2025-10-16 15:42:49 -07:00
gso.c	net: introduce struct net_hotdata	2024-03-07 21:12:41 -08:00
hotdata.c	net: increase skb_defer_max default to 128	2025-11-07 19:02:40 -08:00
hwbm.c
ieee8021q_helpers.c	net: ieee8021q: fix insufficient table-size assertion	2025-07-01 12:55:49 +02:00
link_watch.c	net: replace use of system_unbound_wq with system_dfl_wq	2025-09-22 17:40:30 -07:00
lock_debug.c	netdev: fix the locking for netdev notifications	2025-04-17 18:55:14 -07:00
lwt_bpf.c	ipv4: Convert ->flowi4_tos to dscp_t.	2025-08-26 17:34:31 -07:00
lwtunnel.c	inet: Remove rtnl_is_held arg of lwtunnel_valid_encap_type(_attr)?().	2025-05-20 19:18:24 -07:00
Makefile	queue_api: add support for fetching per queue DMA dev	2025-08-28 16:05:31 -07:00
mp_dmabuf_devmem.h	memory-provider: dmabuf devmem memory provider	2024-09-11 20:44:31 -07:00
neighbour.c	neighbour: Convert rwlock of struct neigh_table to spinlock.	2025-10-24 17:57:20 -07:00
net_namespace.c	Networking changes for 6.19.	2025-12-03 17:24:33 -08:00
net_test.c	pfcp: always set pfcp metadata	2024-04-01 10:49:28 +01:00
net-procfs.c	net: use NUMA drop counters for softnet_data.dropped	2025-09-14 11:35:17 -07:00
net-sysfs.c	Networking changes for 6.18.	2025-10-02 15:17:01 -07:00
net-sysfs.h	net: remove RTNL use for /proc/sys/net/core/rps_default_mask	2025-07-07 18:42:12 -07:00
net-traces.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
netclassid_cgroup.c	net, bpf: Fix RCU usage in task_cls_state() for BPF programs	2025-06-11 21:30:29 +02:00
netdev_queues.c	queue_api: add support for fetching per queue DMA dev	2025-08-28 16:05:31 -07:00
netdev_rx_queue.c	net: add helper to pre-check if PP for an Rx queue will be unreadable	2025-09-04 10:19:17 +02:00
netdev-genl-gen.c	tools: ynl-gen: add regeneration comment	2025-11-25 19:20:42 -08:00
netdev-genl-gen.h	tools: ynl-gen: add regeneration comment	2025-11-25 19:20:42 -08:00
netdev-genl.c	net: devmem: allow binding on rx queues with same DMA devices	2025-08-28 16:05:32 -07:00
netevent.c
netmem_priv.h	netmem: replace __netmem_clear_lsb() with netmem_to_nmdesc()	2025-10-14 13:37:26 +02:00
netpoll.c	net: netpoll: initialize work queue before error checks	2025-11-28 20:16:57 -08:00
netprio_cgroup.c
of_net.c	net: Explicitly include correct DT includes	2023-07-27 20:33:16 -07:00
page_pool_priv.h	net: page_pool: don't try to stash the napi id	2025-01-27 14:37:41 -08:00
page_pool_user.c	net: use napi_id_valid helper	2025-02-17 16:43:04 -08:00
page_pool.c	net: page_pool: sanitise allocation order	2025-12-02 11:08:39 -08:00
pktgen.c	net: pktgen: Use min()/min_t() to improve pktgen_finalize_skb()	2025-08-21 10:12:11 +02:00
ptp_classifier.c	ptp: Add generic PTP is_sync() function	2022-03-07 11:31:34 +00:00
request_sock.c	tcp: Remove stale locking comment for TFO.	2025-09-23 18:21:36 -07:00
rtnetlink.c	rtnetlink: honor RTEXT_FILTER_SKIP_STATS in IFLA_STATS	2025-11-04 16:07:37 -08:00
scm.c	scm: Convert put_cmsg() to scoped user access	2025-11-18 15:27:34 +01:00
secure_seq.c	net: Retire DCCP socket.	2025-04-11 18:58:10 -07:00
selftests.c	net: selftests: export packet creation helpers for driver use	2025-11-06 13:38:11 +01:00
skb_fault_injection.c	net: Implement fault injection forcing skb reallocation	2024-11-12 12:05:33 +01:00
skbuff.c	net: fix memory leak in skb_segment_list for GRO packets	2026-01-05 17:01:28 -08:00
skmsg.c	bpf, sockmap: Fix FIONREAD for sockmap	2026-01-27 09:11:30 -08:00
sock_destructor.h
sock_diag.c	net: WQ_PERCPU added to alloc_workqueue users	2025-09-22 17:40:30 -07:00
sock_map.c	bpf: Remove attach_type in sockmap_link	2025-07-11 10:51:55 -07:00
sock_reuseport.c	net: core: annotate socks of struct sock_reuseport with __counted_by	2024-08-02 17:16:59 -07:00
sock.c	net: sock: fix hardened usercopy panic in sock_recv_errqueue	2026-01-04 09:54:32 -08:00
stream.c	net: stream: add description for sk_stream_write_space()	2025-07-18 16:57:21 -07:00
sysctl_net_core.c	net: Introduce net.core.bypass_prot_mem sysctl.	2025-10-16 12:04:47 -07:00
timestamping.c	net: Add the possibility to support a selected hwtstamp in netdevice	2024-12-16 12:51:40 +00:00
tso.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
utils.c	net: Fix checksum update for ILA adj-transport	2025-05-30 19:53:51 -07:00
xdp.c	bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs	2026-01-02 12:04:28 -08:00