Re: [PATCH bpf-next v2 3/9] bpf: fetch the vmlinux BTF where kernel types enter a program

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: NULL pointer dereference in process_arg_ptr_to_btf_id due to missing ARG_PTR_TO_BTF_ID_SOCK_COMMON
--

commit 84d2361be82e8cb989ae15ca8d3347130aa3ce1b
Author: Jay Wang <wanjay@amazon.com>

bpf: fetch the vmlinux BTF where kernel types enter a program

This commit defers fetching the vmlinux BTF in the BPF verifier until
kernel types are actually needed by a program. This optimization avoids
loading and parsing BTF data for programs that do not use kernel types,
such as simple socket filters.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index a7c9e2d8965d5..f02ecb0dae75c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -11568,6 +11570,24 @@ static int release_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
>  	return err;
>  }
>  
> +/* Does calling helper @func_id bring kernel BTF types into the program? */
> +static bool helper_uses_vmlinux_btf(enum bpf_func_id func_id,
> +				    const struct bpf_func_proto *fn)
> +{
> +	int i;
> +
> +	/* these take the kernel type id in a struct btf_ptr, not in a register */
> +	if (func_id == BPF_FUNC_snprintf_btf || func_id == BPF_FUNC_seq_printf_btf)
> +		return true;
> +	if (base_type(fn->ret_type) == RET_PTR_TO_BTF_ID)
> +		return true;
> +	for (i = 0; i < MAX_BPF_FUNC_ARGS; i++) {
> +		if (base_type(fn->arg_type[i]) == ARG_PTR_TO_BTF_ID)
> +			return true;

[Severity: High]
Does this logic also need to check for ARG_PTR_TO_BTF_ID_SOCK_COMMON?

If ARG_PTR_TO_BTF_ID_SOCK_COMMON is omitted here, helpers like
bpf_sk_release() that accept this argument type will skip loading
btf_vmlinux.

If a program synthesizes a PTR_TO_BTF_ID pointing to a module's BTF using
ldimm64, btf_vmlinux could remain NULL. Later, in check_func_args(),
arg_btf is assigned from btf_vmlinux:

check_func_args() {
    ...
    case ARG_PTR_TO_BTF_ID:
    case ARG_PTR_TO_BTF_ID_SOCK_COMMON:
    {
        const u32 *arg_btf_id = fn->arg_btf_id[arg];
        const struct btf *arg_btf = meta->btf ?: btf_vmlinux;
    ...
}

Because btf_vmlinux is NULL, arg_btf becomes NULL. Could this lead to a
NULL pointer dereference when process_arg_ptr_to_btf_id() unconditionally
dereferences it?

process_arg_ptr_to_btf_id() {
    ...
    arg_t = btf_type_skip_modifiers(arg_btf, arg_btf_id, &arg_btf_id);
    ...
}

> +	}
> +	return false;
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925211314.5118-1-wanjay@amazon.com?part=3