Re: [PATCH bpf 1/2] bpf: Fix NULL-ptr-deref when dumping a key-less BTF hash map

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] btf_modifier_show dereferences NULL when a modifier resolves to a void type.
--

commit 36dc7c26f56375bd142801da1fcbc83e4a765c35
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

bpf: Fix NULL-ptr-deref when dumping a key-less BTF hash map
    
This patch fixes a NULL pointer dereference in btf_type_show() that occurs
when dumping a key-less BTF hash map. It restores previous behavior by
rejecting key-less BTF in hash map check callbacks, and adds a NULL check
for void types in btf_type_show() to gracefully handle any other paths.

Reported-by: syzbot+37b56485bbbf90ad8489@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a8f4e88.27659fcc.2ceef7.0008.GAE@google.com/T/
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index da36d4b9d31ab..c32265dc4ae7e 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -8229,6 +8229,10 @@ static void btf_type_show(const struct btf *btf, u32 type_id, void *obj,
>  	memset(&show->state, 0, sizeof(show->state));
>  	memset(&show->obj, 0, sizeof(show->obj));
>  
> +	/* A void type (e.g. type_id 0) has no show op, don't deref NULL. */
> +	if (!t || !btf_type_ops(t))
> +		return;
> +
>  	btf_type_ops(t)->show(btf, t, type_id, obj, 0, show);
>  }

[Severity: High]
This is a pre-existing issue, but does this fix need to be extended to
btf_modifier_show() as well?

If a user with BPF tracing privileges invokes the bpf_snprintf_btf() helper
with a btf_id of a modifier that points to void (e.g., const void),
btf_type_show() will see the modifier type and pass this check since
modifier_ops is not NULL.

Execution would then proceed to btf_modifier_show(), which strips the modifier
and resolves the underlying type to btf_void:

kernel/bpf/btf.c:btf_modifier_show() {
	if (btf->resolved_ids)
		t = btf_type_id_resolve(btf, &type_id);
	else
		t = btf_type_skip_modifiers(btf, type_id, NULL);

	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
}

Since btf_type_ops(t) for btf_void is NULL, wouldn't this unconditional call
result in an immediate NULL pointer dereference, bypassing the check added
here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828093142.179856-1-jiayuan.chen@linux.dev?part=1