[PATCH bpf-next v4 0/4] bpf: Fix refcount_acquire handling for borrowed kptrs

[Ning Ding <dingning04@gmail.com>]

Fix two verifier bugs involving bpf_refcount_acquire() and map kptrs.

First, the verifier can mistake an RCU-loaded map kptr for an owned
reference and assume bpf_refcount_acquire() cannot return NULL. The kfunc
can return NULL after the last reference is dropped, so passing an
unchecked result to bpf_obj_drop() can crash the kernel.

Second, type_is_ptr_alloc_obj() accepts PTR_UNTRUSTED pointers. This lets a
pointer that is no longer protected by RCU reach bpf_refcount_acquire(). If
the object was freed and its address reused, the verifier may acquire a
reference through stale memory.

Patches 1 and 2 fix and test the return-value nullability. Patches 3 and 4
reject untrusted allocated-object pointers while keeping safe
BPF_PROBE_MEM reads accepted.

The series is based on bpf-next commit 806c1a185215
("Merge branch 'bpf-introduce-global-percpu-data'").

Testing used a fresh virtme-ng KVM boot with KASAN enabled:

  full test_progs:           757/6685 passed, 7858 skipped, 0/0 failed
  KASAN/Oops/panic markers:  none

---
v4:
  - Rebase and retarget the series onto bpf-next.
  - Change only the affected verifier test program sections from ?tc to
    sleepable ?syscall, as suggested by Kumar Kartikeya Dwivedi; leave the
    test logic unchanged.
  - Drop Cc: stable@vger.kernel.org.
  - Rerun the full unfiltered test_progs suite.

v3:
  - Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED, as suggested by
    Kumar Kartikeya Dwivedi.
  - Add a separate helper for the BPF_PROBE_MEM read path.
  - Add read, refcount-acquire, and direct-write verifier tests.
  - Add Cc: stable@vger.kernel.org to both fixes, as requested by Greg
    Kroah-Hartman.
  - Split each fix from its selftests.

v3: https://lore.kernel.org/r/20260803112218.3361213-1-dingning04@gmail.com
v2: https://lore.kernel.org/r/20260726235030.1152542-1-dingning04@gmail.com
v1: https://lore.kernel.org/r/20260726015330.705259-1-dingning04@gmail.com

Ning Ding (4):
  bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
  selftests/bpf: Test refcount_acquire return nullability
  bpf: Reject untrusted allocated-object pointers
  selftests/bpf: Test untrusted allocated-object pointers

 include/linux/bpf_verifier.h                  |  11 +-
 kernel/bpf/verifier.c                         |  10 +-
 .../selftests/bpf/progs/refcounted_kptr.c     | 161 ++++++++++++++++++
 .../bpf/progs/refcounted_kptr_fail.c          |  74 ++++++++
 4 files changed, 253 insertions(+), 3 deletions(-)


base-commit: 806c1a185215382fab5a7fafc74e30070b2fb043
-- 
2.43.0