Re: [RFC PATCH bpf-next v1 10/16] bpf: Let typed_arena_cast copy pointers the verifier already trusts

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: check_typed_arena_cast() misses src->off check causing state mismatch
--

commit e8c7f600f2244019888ad241fa81b63bc3bccf3d
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Let typed_arena_cast copy pointers the verifier already trusts

The compiler inserts the cast at every use of a pointer to a struct with
special fields, so that programs never write one, and it cannot tell what
the pointer is: the same struct lives in typed arenas, in allocated objects,
in map values and on the stack. So the verifier decides per path what the
cast takes.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b85d99f81ef54..aceb17e629481 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -17320,6 +17358,18 @@ static int check_typed_arena_cast(struct bpf_verifier_env *env, struct bpf_insn
>  		return PTR_ERR(ta);
>  	aux->typed_arena = ta;
>  
> +	if (src->type == (PTR_TO_BTF_ID | MEM_ARENA) && src->btf_id == ta->btf_id &&
> +	    tnum_is_const(src->var_off) && !src->var_off.value) {

[Severity: High]
Does check_typed_arena_cast() need to ensure src->off == 0 here?

If a BPF program uses typed_arena_cast on a control flow path where one branch
provides a SCALAR_VALUE (setting aux->sanitize_needed = true) and the other
branch provides a PTR_TO_BTF_ID | MEM_ARENA with a non-zero fixed offset
(src->off > 0), the runtime sanitization sequence drops the offset by masking
it to 0, but the verifier retains the non-zero offset.

Could this state mismatch allow a program to subtract the offset and access
memory before the arena object, bypassing verifier bounds checks?

> +		*dst = *src;
> +		return 0;
> +	}
> +	if (aux->sanitize_plain) {
> +		verbose(env, "insn %d casts values that need different treatment on different paths\n",
> +			env->insn_idx);
> +		return -EINVAL;
> +	}
> +	aux->sanitize_needed = true;
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926233503.3114147-1-memxor@gmail.com?part=10