Re: [PATCH bpf v2 2/4] bpf: Fix NULL-ptr-deref when showing a void BTF type

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] NULL pointer dereference in `btf_var_show()` when rendering vmlinux BTF types via `bpf_snprintf_btf()`.
--

commit f9ef7fc1b664c580ca28b8d18cae855dd7b0e940
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

bpf: Fix NULL-ptr-deref when showing a void BTF type

This patch fixes a NULL pointer dereference when btf_modifier_show() attempts
to render a void type. Because void lacks a show op, it falls back to
btf_df_show() instead of dereferencing a NULL pointer.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index da36d4b9d31ab..81506cbb9f9ae 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -2911,7 +2911,15 @@ static void btf_modifier_show(const struct btf *btf,
>  	else
>  		t = btf_type_skip_modifiers(btf, type_id, NULL);
>  
> -	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
> +	/*
> +	 * A modifier can resolve to the void type (e.g. "const void"), which
> +	 * has no show op (kind_ops[BTF_KIND_UNKN] is NULL). Print a placeholder
> +	 * instead of dereferencing NULL.
> +	 */
> +	if (!btf_type_ops(t))
> +		btf_df_show(btf, t, type_id, data, bits_offset, show);
> +	else
> +		btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
>  }
>  
>  static void btf_var_show(const struct btf *btf, const struct btf_type *t,
>  			 u32 type_id, void *data, u8 bits_offset,
>  			 struct btf_show *show)
>  {
>  	t = btf_type_id_resolve(btf, &type_id);

[Severity: High]
This isn't a bug introduced by this patch, but while looking at this fix, I
noticed a potential issue in btf_var_show() just below it.

Can btf_var_show() cause a NULL pointer dereference when rendering vmlinux
BTF types via bpf_snprintf_btf()?

If a BPF program calls the bpf_snprintf_btf() helper and passes the type ID
of a BTF_KIND_VAR from the vmlinux BTF, formatting will dispatch to
btf_var_show().

This function unconditionally calls btf_type_id_resolve(), which attempts to
dereference btf->resolved_ids.

However, since type resolution is skipped for base BTF during parsing,
btf->resolved_ids is NULL for vmlinux BTF. Does this unconditionally result in
a NULL pointer dereference inside btf_type_id_resolve()?

>  
>  	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830073242.148092-1-jiayuan.chen@linux.dev?part=2