Re: [PATCH bpf-next v2 11/18] bpf: Classify kfunc mem_size args from BTF without register state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Removing the `SCALAR_VALUE` check from `is_kfunc_arg_mem_size()` and `is_kfunc_arg_const_mem_size()` allows unvalidated pointer registers to be passed as memory size arguments during kfunc lookahead validation, triggering a `verifier_bug` kernel warning splat and local DoS.
--

--- Patch [11]: [PATCH bpf-next v2 11/18] bpf: Classify kfunc mem_size args from BTF without register state ---
commit 55013229ec44003dda12328783652d410aa4f75e
Author: Amery Hung <ameryhung@gmail.com>

bpf: Classify kfunc mem_size args from BTF without register state

This commit drops the scalar register type check in is_kfunc_arg_mem_size()
and is_kfunc_arg_const_mem_size() to decouple get_kfunc_ptr_arg_type()
from register state.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 0f8d403083177..f6b373630ca95 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -10795,26 +10795,24 @@ static bool is_kfunc_rcu_protected(struct bpf_call_arg_meta *meta)
>  }
>  
>  static bool is_kfunc_arg_mem_size(const struct btf *btf,
> -				  const struct btf_param *arg,
> -				  const struct bpf_reg_state *reg)
> +				  const struct btf_param *arg)
>  {
>  	const struct btf_type *t;
>  
>  	t = btf_type_skip_modifiers(btf, arg->type, NULL);
> -	if (!btf_type_is_scalar(t) || reg->type != SCALAR_VALUE)
> +	if (!btf_type_is_scalar(t))
>  		return false;
>  
>  	return btf_param_match_suffix(btf, arg, "__sz");
>  }

[Severity: High]
Could this removal allow a pointer register to be incorrectly classified as a
memory size parameter during kfunc lookahead validation?

If a BPF program passes a pointer register (such as PTR_TO_STACK with a fixed
offset of 0) instead of a scalar to a size argument suffixed with __sz,
get_kfunc_ptr_arg_type() will now look ahead and classify it solely based on
the BTF signature.

Because of this classification, check_kfunc_args() eagerly processes the
unverified register as a size parameter before the generic scalar validation
loop catches it:

check_kfunc_args()
    ...
    check_mem_size_reg(env, buff_reg, size_reg, argno, next_argno, ...)

Inside check_mem_size_reg(), the pointer with a fixed offset of 0 yields a
size of 0. Since zero-size is allowed, it passes the bounds check and calls
mark_chain_precision() on the pointer register.

Because mark_chain_precision() expects a SCALAR_VALUE, it triggers a
verifier_bug splat for backtracking misuse when given a pointer. On systems
configured with panic_on_warn, this creates a local denial of service
regression.

Should the register type check be retained here, or is there another way to
prevent pointer registers from bypassing validation during the lookahead?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724190813.1458271-1-ameryhung@gmail.com?part=11