Re: [PATCH bpf-next v4 3/4] bpf: Reject untrusted allocated-object pointers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Missing Invalidation / Use-After-Free: Untrusted non-owning references bypass invalidation on bpf_spin_unlock(), leading to a kernel panic upon subsequent memory access.
--

--- Patch [3]: [PATCH bpf-next v4 3/4] bpf: Reject untrusted allocated-object pointers ---
commit 7424ccf28aa2cdb4011681f68f04f8f438496194
Author: Ning Ding <dingning04@gmail.com>

bpf: Reject untrusted allocated-object pointers

type_is_ptr_alloc_obj() treats PTR_UNTRUSTED pointers as valid allocated
objects, allowing unprotected pointers to be passed to bpf_refcount_acquire().
This patch makes type_is_ptr_alloc_obj() reject PTR_UNTRUSTED to prevent
acquiring references through stale memory. It also adds a new helper for the
read path where these pointers are still allowed for BPF_PROBE_MEM reads.

Link: https://lore.kernel.org/r/20260726021304.97ED91F000E9@smtp.kernel.org

> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> index 27b43fda9b178..22fcd01c3cceb 100644
> --- a/include/linux/bpf_verifier.h
> +++ b/include/linux/bpf_verifier.h
> @@ -1341,7 +1341,16 @@ static inline bool bpf_type_has_unsafe_modifiers(u32 type)
>  
>  static inline bool type_is_ptr_alloc_obj(u32 type)
>  {
> -	return base_type(type) == PTR_TO_BTF_ID && type_flag(type) & MEM_ALLOC;
> +	return base_type(type) == PTR_TO_BTF_ID &&
> +	       type_flag(type) & MEM_ALLOC &&
> +	       !(type_flag(type) & PTR_UNTRUSTED);
> +}
> +
> +static inline bool type_is_untrusted_ptr_alloc_obj(u32 type)
> +{
> +	return base_type(type) == PTR_TO_BTF_ID &&
> +	       type_flag(type) & MEM_ALLOC &&
> +	       type_flag(type) & PTR_UNTRUSTED;
>  }
>  
>  static inline bool type_is_non_owning_ref(u32 type)

[Severity: Critical]
By rejecting PTR_UNTRUSTED in type_is_ptr_alloc_obj(), doesn't this break
type_is_non_owning_ref() for untrusted non-owning references?

If a BPF program obtains a non-owning reference to a refcounted object inside
a bpf_rcu_read_lock() and bpf_spin_lock() section, the pointer type is
PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF | MEM_RCU.

Calling bpf_rcu_read_unlock() clears MEM_RCU and sets PTR_UNTRUSTED.

Then, when bpf_spin_unlock() calls invalidate_non_owning_refs(), it appears
the untrusted non-owning reference will not be invalidated because
type_is_non_owning_ref() now returns false.

This could allow the untrusted pointer to survive the lock section. Later
memory reads on this register would fall through the switch statement in
bpf_convert_ctx_accesses() because it does not match
PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF | PTR_UNTRUSTED.

Would this result in a native load without PROBE_MEM fault protection,
potentially causing a kernel panic on freed memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813211533.290256-1-dingning04@gmail.com?part=3