Re: [PATCH bpf v4 1/2] bpf: Fix kfunc implicit arg inject type detection to prevent invalid pointer deref

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch introduces undeclared identifiers `argno` and `reg_arg_name`, resulting in a fatal compilation error.
--

commit af92ff0b79cc212b53a40ea48cae9a7de79d1a76
Author: Yuan Chen <chenyuan@kylinos.cn>

bpf: Fix kfunc implicit arg inject type detection to prevent invalid pointer deref

This commit fixes a verifier issue where unrecognized implicit kfunc arguments
caused a silent fallthrough instead of being rejected. It updates the checks
in check_kfunc_args() to explicitly return -EFAULT for unrecognized implicit
arguments, preventing a potential invalid pointer dereference or information
disclosure.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 7fb88e1cd7c4d..57e5fdf9f7e06 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -12082,9 +12082,22 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>  			continue;
>  		}
>  
> -		if (is_kfunc_arg_ignore(btf, &args[i]) || is_kfunc_arg_implicit(meta, i))
> +		if (is_kfunc_arg_ignore(btf, &args[i]))
>  			continue;
>  
> +		if (is_kfunc_arg_implicit(meta, i)) {
> +			/* list_push / rbtree_add kfuncs have implicit args
> +			 * (e.g. 'off' parameter) handled during verification
> +			 * in bpf_fixup_kfunc_call().  Don't flag them.
> +			 */
> +			if (is_bpf_list_push_kfunc(meta->func_id) ||
> +			    is_bpf_rbtree_add_kfunc(meta->func_id))
> +				continue;
> +			verbose(env, "%s unrecognized implicit argument, possible BTF mismatch\n",
> +				reg_arg_name(env, argno));

[Severity: Low]
Will this compile cleanly? In check_kfunc_args(), it looks like argno is 
undeclared in this scope, as the local loop index appears to be i.

Also, does reg_arg_name() exist? I am unable to locate a definition for it in
the tree. Could this result in an implicit function declaration error during
the build?

> +			return -EFAULT;
> +		}
> +
>  		t = btf_type_skip_modifiers(btf, args[i].type, NULL);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602093836.2632714-1-chenyuan_fl@163.com?part=1