Re: [PATCH bpf v3 2/5] bpf: Fix NULL-ptr-deref when showing a void BTF type

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] btf_var_show() unconditionally dereferences btf_type_ops(t) which can be NULL if a VAR resolves to the void type.
--

commit e40701f4e16b364aff9e3327fa4cdff79bc39336
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

bpf: Fix NULL-ptr-deref when showing a void BTF type

btf_modifier_show() resolves the modifier and then calls
btf_type_ops(t)->show() unconditionally. For the void type (type_id 0,
BTF_KIND_UNKN) kind_ops[] has no entry, so ->show is NULL.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index da36d4b9d31ab..81506cbb9f9ae 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -2911,7 +2911,15 @@ static void btf_modifier_show(const struct btf *btf,
>  	else
>  		t = btf_type_skip_modifiers(btf, type_id, NULL);
>  
> -	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
> +	/*
> +	 * A modifier can resolve to the void type (e.g. "const void"), which
> +	 * has no show op (kind_ops[BTF_KIND_UNKN] is NULL). Print a placeholder
> +	 * instead of dereferencing NULL.
> +	 */
> +	if (!btf_type_ops(t))
> +		btf_df_show(btf, t, type_id, data, bits_offset, show);
> +	else
> +		btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
>  }
>  
>  static void btf_var_show(const struct btf *btf, const struct btf_type *t,

[Severity: High]
This isn't a bug introduced by this patch, but does btf_var_show() have the
same problem where btf_type_ops(t) can be NULL if a VAR resolves to the void
type?

Looking at btf_var_show() in kernel/bpf/btf.c, it also unconditionally
dereferences btf_type_ops(t):

kernel/bpf/btf.c:btf_var_show() {
	...
	t = btf_type_id_resolve(btf, &type_id);

	btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show);
}

If a BPF program calls the bpf_snprintf_btf helper with the type ID of a
BTF_KIND_VAR that resolves to void (e.g., __nosave_begin in vmlinux, which is
declared as extern const void), could this result in a NULL pointer
dereference?

While later patches in this series address a different NULL pointer
dereference involving btf->resolved_ids within btf_var_show(), it appears
they miss adding this same if (!btf_type_ops(t)) safeguard that was added
here to btf_modifier_show().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831110314.150870-1-jiayuan.chen@linux.dev?part=2