Re: [PATCH bpf v2 2/4] bpf: Require CAP_PERFMON for kfuncs reading memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check for negative enum values in `bpf_mem_cgroup_memory_events` kfunc.
--

commit cdc4306f1568d5f9112eea54321dd73200076861
Author: Daniel Borkmann <daniel@iogearbox.net>

bpf: Require CAP_PERFMON for kfuncs reading memory

This commit restricts several memory-reading and fault-safe probe BPF kernel
functions (kfuncs) by marking them with the KF_PERFMON flag. It ensures that
these functions, such as bpf_rdonly_cast and bpf_get_kmem_cache, now require
CAP_PERFMON privileges to prevent unprivileged memory access.

> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
[ ... ]

While reviewing the BPF kfuncs context, I noticed a related concern in
bpf_mem_cgroup_memory_events() located in mm/bpf_memcontrol.c.

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for a negative
enum value to bypass the bounds check here?

mm/bpf_memcontrol.c:bpf_mem_cgroup_memory_events() {
        ...
        if (unlikely(event >= MEMCG_NR_MEMORY_EVENTS))
                return (unsigned long)-1;

        return atomic_long_read(&memcg->memory_events[event]);
}

The BPF verifier allows unconstrained scalar arguments for enums and does
not enforce enum bounds internally. If a BPF program passes a negative
integer as the event parameter (such as -1), the >= check evaluates to
false because enums are treated as signed integers.

Could this lead to an out-of-bounds read of kernel memory when the negative
event index is used to access the memory_events array?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910213510.49358-1-daniel@iogearbox.net?part=2