Re: [PATCH bpf v6 1/2] bpf: Fix kfunc implicit arg inject type detection to prevent invalid pointer deref

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch introduces a hard compilation error by referencing an undeclared variable `argno` and an undefined function `reg_arg_name()`.
--

commit 73eb7a1ebaf3a1d6b87a679580f3e6dc96801fe5
Author: Yuan Chen <chenyuan@kylinos.cn>
bpf: Fix kfunc implicit arg inject type detection to prevent invalid pointer deref

This commit fixes a vulnerability where an implicit bpf_prog_aux argument
could be bypassed due to BTF dedup failures, leading to arbitrary kernel
memory dereference. It ensures the verifier strictly validates and either
injects the correct pointer or explicitly rejects the program.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -12082,9 +12082,28 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
[ ... ]
> +		if (is_kfunc_arg_implicit(meta, i)) {
> +			/*
> +			 * This is an exhaustive list of the non-bpf_prog_aux
> +			 * implicit args kfuncs, which are handled
> +			 * post-verification by bpf_fixup_kfunc_call().
> +			 */
> +			if (is_bpf_obj_new_kfunc(meta->func_id) ||
> +			    is_bpf_percpu_obj_new_kfunc(meta->func_id) ||
> +			    is_bpf_obj_drop_kfunc(meta->func_id) ||
> +			    is_bpf_percpu_obj_drop_kfunc(meta->func_id) ||
> +			    is_bpf_refcount_acquire_kfunc(meta->func_id) ||
> +			    is_bpf_list_push_kfunc(meta->func_id) ||
> +			    is_bpf_rbtree_add_kfunc(meta->func_id))
> +				continue;
> +			verbose(env, "%s unrecognized implicit argument, possible BTF mismatch\n",
> +				reg_arg_name(env, argno));

[Severity: Low]
Does this code compile? It looks like it introduces a build error by
referencing argno, which is not defined in this scope.

Also, is reg_arg_name() defined anywhere? It doesn't appear to be declared
or defined in the kernel tree.

> +			return -EFAULT;
> +		}
> +
>  		t = btf_type_skip_modifiers(btf, args[i].type, NULL);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609125214.3096351-1-chenyuan_fl@163.com?part=1