Disallow combining BPF_F_LOCK with map values that contain special BTF
fields other than bpf_spin_lock (e.g. kptr or uptr). Such mixing may lead
to subtle or undefined behavior in map value updating. Reject these
combinations early by returning -EOPNOTSUPP.
Centralize map update flag validation in bpf_map_check_op_flags() and
reuse it across array, hash, local-storage, and task-storage map update
paths. Explicitly reject incompatible BPF_NOEXIST/BPF_EXIST combinations
and invalid BPF_F_LOCK usage to keep flag validation consistent and
eliminate duplicated per-map checks.
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
include/linux/bpf.h | 7 +++++++
kernel/bpf/arraymap.c | 11 ++++-------
kernel/bpf/bpf_local_storage.c | 7 -------
kernel/bpf/bpf_task_storage.c | 3 ---
kernel/bpf/hashtab.c | 8 +++-----
5 files changed, 14 insertions(+), 22 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 5936f8e2996f..c5863487ee73 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -3935,9 +3935,16 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all
if ((u32)flags & ~allowed_flags)
return -EINVAL;
+ /* BPF_NOEXIST and BPF_EXIST are mutually exclusive. */
+ if ((flags & (BPF_NOEXIST | BPF_EXIST)) == (BPF_NOEXIST | BPF_EXIST))
+ return -EINVAL;
+
if ((flags & BPF_F_LOCK) && !btf_record_has_field(map->record, BPF_SPIN_LOCK))
return -EINVAL;
+ if ((flags & BPF_F_LOCK) && btf_record_has_field(map->record, ~BPF_SPIN_LOCK))
+ return -EOPNOTSUPP;
+
if (!(flags & BPF_F_CPU) && flags >> 32)
return -EINVAL;
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 67e9e811de3a..1cff40f109cd 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -366,10 +366,7 @@ static long array_map_update_elem(struct bpf_map *map, void *key, void *value,
struct bpf_array *array = container_of(map, struct bpf_array, map);
u32 index = *(u32 *)key;
char *val;
-
- if (unlikely((map_flags & ~BPF_F_LOCK) > BPF_EXIST))
- /* unknown flags */
- return -EINVAL;
+ int err;
if (unlikely(index >= array->map.max_entries))
/* all elements were pre-allocated, cannot insert a new one */
@@ -379,9 +376,9 @@ static long array_map_update_elem(struct bpf_map *map, void *key, void *value,
/* all elements already exist */
return -EEXIST;
- if (unlikely((map_flags & BPF_F_LOCK) &&
- !btf_record_has_field(map->record, BPF_SPIN_LOCK)))
- return -EINVAL;
+ err = bpf_map_check_op_flags(map, map_flags, BPF_EXIST | BPF_F_LOCK);
+ if (unlikely(err))
+ return err;
if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
val = this_cpu_ptr(array->pptrs[index & array->index_mask]);
diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c
index e2fe6c32822b..80b50091cbbf 100644
--- a/kernel/bpf/bpf_local_storage.c
+++ b/kernel/bpf/bpf_local_storage.c
@@ -493,13 +493,6 @@ bpf_local_storage_update(void *owner, struct bpf_local_storage_map *smap,
unsigned long flags;
int err;
- /* BPF_EXIST and BPF_NOEXIST cannot be both set */
- if (unlikely((map_flags & ~BPF_F_LOCK) > BPF_EXIST) ||
- /* BPF_F_LOCK can only be used in a value with spin_lock */
- unlikely((map_flags & BPF_F_LOCK) &&
- !btf_record_has_field(smap->map.record, BPF_SPIN_LOCK)))
- return ERR_PTR(-EINVAL);
-
if (gfp_flags == GFP_KERNEL && (map_flags & ~BPF_F_LOCK) != BPF_NOEXIST)
return ERR_PTR(-EINVAL);
diff --git a/kernel/bpf/bpf_task_storage.c b/kernel/bpf/bpf_task_storage.c
index a1dc1bf0848a..21d84818e64e 100644
--- a/kernel/bpf/bpf_task_storage.c
+++ b/kernel/bpf/bpf_task_storage.c
@@ -125,9 +125,6 @@ static long bpf_pid_task_storage_update_elem(struct bpf_map *map, void *key,
struct pid *pid;
int fd, err;
- if ((map_flags & BPF_F_LOCK) && btf_record_has_field(map->record, BPF_UPTR))
- return -EOPNOTSUPP;
-
fd = *(int *)key;
pid = pidfd_get_pid(fd, &f_flags);
if (IS_ERR(pid))
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 3b9d297a53be..2f6ed3e80308 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -1093,9 +1093,9 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,
u32 key_size, hash;
int ret;
- if (unlikely((map_flags & ~BPF_F_LOCK) > BPF_EXIST))
- /* unknown flags */
- return -EINVAL;
+ ret = bpf_map_check_op_flags(map, map_flags, BPF_NOEXIST | BPF_EXIST | BPF_F_LOCK);
+ if (unlikely(ret))
+ return ret;
WARN_ON_ONCE(!bpf_rcu_lock_held());
@@ -1107,8 +1107,6 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,
head = &b->head;
if (unlikely(map_flags & BPF_F_LOCK)) {
- if (unlikely(!btf_record_has_field(map->record, BPF_SPIN_LOCK)))
- return -EINVAL;
/* find an element without taking the bucket lock */
l_old = lookup_nulls_elem_raw(head, hash, key, key_size,
htab->n_buckets);
--
2.52.0> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 5936f8e2996f..c5863487ee73 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -3935,9 +3935,16 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all
> if ((u32)flags & ~allowed_flags)
> return -EINVAL;
>
> + /* BPF_NOEXIST and BPF_EXIST are mutually exclusive. */
> + if ((flags & (BPF_NOEXIST | BPF_EXIST)) == (BPF_NOEXIST | BPF_EXIST))
> + return -EINVAL;
> +
> if ((flags & BPF_F_LOCK) && !btf_record_has_field(map->record, BPF_SPIN_LOCK))
> return -EINVAL;
>
> + if ((flags & BPF_F_LOCK) && btf_record_has_field(map->record, ~BPF_SPIN_LOCK))
> + return -EOPNOTSUPP;
> +
> if (!(flags & BPF_F_CPU) && flags >> 32)
> return -EINVAL;
[ ... ]
> diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c
> index e2fe6c32822b..80b50091cbbf 100644
> --- a/kernel/bpf/bpf_local_storage.c
> +++ b/kernel/bpf/bpf_local_storage.c
> @@ -493,13 +493,6 @@ bpf_local_storage_update(void *owner, struct bpf_local_storage_map *smap,
> unsigned long flags;
> int err;
>
> - /* BPF_EXIST and BPF_NOEXIST cannot be both set */
> - if (unlikely((map_flags & ~BPF_F_LOCK) > BPF_EXIST) ||
> - /* BPF_F_LOCK can only be used in a value with spin_lock */
> - unlikely((map_flags & BPF_F_LOCK) &&
> - !btf_record_has_field(smap->map.record, BPF_SPIN_LOCK)))
> - return ERR_PTR(-EINVAL);
^^^^
This validation was removed from bpf_local_storage_update() but it appears
that no call to bpf_map_check_op_flags() was added in the local storage map
update functions. For array and hash maps, calls to bpf_map_check_op_flags()
were added in array_map_update_elem() and htab_map_update_elem(). However,
the local storage update functions like bpf_cgrp_storage_update_elem(),
bpf_fd_inode_storage_update_elem(), and bpf_fd_sk_storage_update_elem() pass
map_flags directly to bpf_local_storage_update() without calling
bpf_map_check_op_flags() first.
The syscall path does call bpf_map_check_op_flags() in map_update_elem() with
allowed_flags set to ~0, which catches the NOEXIST/EXIST mutual exclusion and
BPF_F_LOCK validation. But with allowed_flags=~0, the check for unknown flags
((u32)flags & ~allowed_flags) always passes zero, meaning unknown flags like
8 or 16 would not be rejected.
The old check (map_flags & ~BPF_F_LOCK) > BPF_EXIST rejected any unknown flag
bits. Is there a missing call to bpf_map_check_op_flags() in the local storage
update functions that should specify the allowed flags?
> -
> if (gfp_flags == GFP_KERNEL && (map_flags & ~BPF_F_LOCK) != BPF_NOEXIST)
> return ERR_PTR(-EINVAL);
[ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21254704407
On 2026/1/23 00:02, bot+bpf-ci@kernel.org wrote: >> diff --git a/include/linux/bpf.h b/include/linux/bpf.h >> index 5936f8e2996f..c5863487ee73 100644 >> --- a/include/linux/bpf.h >> +++ b/include/linux/bpf.h >> @@ -3935,9 +3935,16 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all >> if ((u32)flags & ~allowed_flags) >> return -EINVAL; >> >> + /* BPF_NOEXIST and BPF_EXIST are mutually exclusive. */ >> + if ((flags & (BPF_NOEXIST | BPF_EXIST)) == (BPF_NOEXIST | BPF_EXIST)) >> + return -EINVAL; >> + >> if ((flags & BPF_F_LOCK) && !btf_record_has_field(map->record, BPF_SPIN_LOCK)) >> return -EINVAL; >> >> + if ((flags & BPF_F_LOCK) && btf_record_has_field(map->record, ~BPF_SPIN_LOCK)) >> + return -EOPNOTSUPP; >> + >> if (!(flags & BPF_F_CPU) && flags >> 32) >> return -EINVAL; > > [ ... ] > >> diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c >> index e2fe6c32822b..80b50091cbbf 100644 >> --- a/kernel/bpf/bpf_local_storage.c >> +++ b/kernel/bpf/bpf_local_storage.c >> @@ -493,13 +493,6 @@ bpf_local_storage_update(void *owner, struct bpf_local_storage_map *smap, >> unsigned long flags; >> int err; >> >> - /* BPF_EXIST and BPF_NOEXIST cannot be both set */ >> - if (unlikely((map_flags & ~BPF_F_LOCK) > BPF_EXIST) || >> - /* BPF_F_LOCK can only be used in a value with spin_lock */ >> - unlikely((map_flags & BPF_F_LOCK) && >> - !btf_record_has_field(smap->map.record, BPF_SPIN_LOCK))) >> - return ERR_PTR(-EINVAL); > ^^^^ > > This validation was removed from bpf_local_storage_update() but it appears > that no call to bpf_map_check_op_flags() was added in the local storage map > update functions. For array and hash maps, calls to bpf_map_check_op_flags() > were added in array_map_update_elem() and htab_map_update_elem(). However, > the local storage update functions like bpf_cgrp_storage_update_elem(), > bpf_fd_inode_storage_update_elem(), and bpf_fd_sk_storage_update_elem() pass > map_flags directly to bpf_local_storage_update() without calling > bpf_map_check_op_flags() first. > > The syscall path does call bpf_map_check_op_flags() in map_update_elem() with > allowed_flags set to ~0, which catches the NOEXIST/EXIST mutual exclusion and > BPF_F_LOCK validation. But with allowed_flags=~0, the check for unknown flags > ((u32)flags & ~allowed_flags) always passes zero, meaning unknown flags like > 8 or 16 would not be rejected. > Correct. Such flags should indeed be rejected in the local storage update path. Thanks, Leon > The old check (map_flags & ~BPF_F_LOCK) > BPF_EXIST rejected any unknown flag > bits. Is there a missing call to bpf_map_check_op_flags() in the local storage > update functions that should specify the allowed flags? > >> - >> if (gfp_flags == GFP_KERNEL && (map_flags & ~BPF_F_LOCK) != BPF_NOEXIST) >> return ERR_PTR(-EINVAL); > > [ ... ] > > > --- > AI reviewed your patch. Please fix the bug or email reply why it's not a bug. > See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md > > CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21254704407
© 2016 - 2026 Red Hat, Inc.