From: Eduard Zingerman <eddyz87@gmail.com>
To: Kumar Kartikeya Dwivedi <memxor@gmail.com>, bpf@vger.kernel.org
Cc: Nicholas Carlini <npc@anthropic.com>,
Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Emil Tsalapatis <emil@etsalapatis.com>,
kkd@meta.com, kernel-team@meta.com
Subject: Re: [PATCH bpf v1 5/8] bpf: Mark NULL kptr stores precise
Date: Fri, 04 Sep 2026 09:35:16 -0700 [thread overview]
Message-ID: <40418ce913972dc14276a2e8954cd63595c5eee6.camel@gmail.com> (raw)
In-Reply-To: <20260904104203.345917-6-memxor@gmail.com>
On Fri, 2026-09-04 at 12:41 +0200, Kumar Kartikeya Dwivedi wrote:
> check_map_kptr_access() permits a scalar store into an untrusted kptr
> field only when the register is known to contain zero. Unlike other
> verifier checks whose outcome depends on a scalar value, it does not mark
> that register precise.
>
> A state checkpoint reached with an imprecise zero can therefore prune a
> second path that reaches the store with an arbitrary nonzero scalar. The
> program can write attacker-controlled bits into the kptr field and load
> them back as a PTR_TO_BTF_ID.
>
> Call mark_chain_precision() before accepting a known-zero register. This
> forces state equivalence to compare its scalar range and makes the verifier
> visit and reject a path carrying a nonzero value.
>
> Fixes: 61df10c7799e ("bpf: Allow storing unreferenced kptr in map")
> Reported-by: Nicholas Carlini <npc@anthropic.com>
> Suggested-by: Nicholas Carlini <npc@anthropic.com>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
...
next prev parent reply other threads:[~2026-09-04 16:35 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 10:41 [PATCH bpf v1 0/8] Misc bug fixes - part 4 Kumar Kartikeya Dwivedi
2026-09-04 10:41 ` [PATCH bpf v1 1/8] bpf: Preserve special fields in recycled rhtab elements Kumar Kartikeya Dwivedi
2026-09-04 10:41 ` [PATCH bpf v1 2/8] selftests/bpf: Test timer field on recycled rhtab element Kumar Kartikeya Dwivedi
2026-09-04 11:12 ` sashiko-bot
2026-09-04 11:47 ` bot+bpf-ci
2026-09-04 10:41 ` [PATCH bpf v1 3/8] bpf: Cancel special fields when recycling rhtab elements Kumar Kartikeya Dwivedi
2026-09-04 11:37 ` sashiko-bot
2026-09-04 11:41 ` Kumar Kartikeya Dwivedi
2026-09-04 11:47 ` bot+bpf-ci
2026-09-04 10:41 ` [PATCH bpf v1 4/8] selftests/bpf: Test rhtab kptr cancellation semantics Kumar Kartikeya Dwivedi
2026-09-04 10:41 ` [PATCH bpf v1 5/8] bpf: Mark NULL kptr stores precise Kumar Kartikeya Dwivedi
2026-09-04 12:12 ` sashiko-bot
2026-09-04 16:35 ` Eduard Zingerman [this message]
2026-09-04 10:41 ` [PATCH bpf v1 6/8] selftests/bpf: Test imprecise scalar kptr stores Kumar Kartikeya Dwivedi
2026-09-04 11:47 ` bot+bpf-ci
2026-09-04 10:41 ` [PATCH bpf v1 7/8] bpf: Preserve inner map identity in callback frames Kumar Kartikeya Dwivedi
2026-09-04 11:47 ` bot+bpf-ci
2026-09-04 10:41 ` [PATCH bpf v1 8/8] selftests/bpf: Test inner map identities in callbacks Kumar Kartikeya Dwivedi
2026-09-04 11:47 ` bot+bpf-ci
2026-09-04 19:30 ` [PATCH bpf v1 0/8] Misc bug fixes - part 4 patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=40418ce913972dc14276a2e8954cd63595c5eee6.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=emil@etsalapatis.com \
--cc=kernel-team@meta.com \
--cc=kkd@meta.com \
--cc=memxor@gmail.com \
--cc=npc@anthropic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.