Re: [PATCH bpf-next v2 4/6] bpf: Rewrite any fault prone load out of a mem or btf_id pointer

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-08-14 at 23:52 +0200, Daniel Borkmann wrote:
> bpf_convert_ctx_accesses() turns a BPF_LDX into a BPF_PROBE_MEM one by
> matching the type recorded for the insn against a list of exact pointer
> types. The list cannot keep up with the flag combinations the verifier
> produces, and a type which is missing from it ends up as a plain load
> without an exception table entry, so a bad address panics the kernel
> instead of being handled.
> 
> Two such types exist today and are reachable:
> 
>   - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_ALLOC | NON_OWN_REF
>   - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_RCU
> 
> Rather than adding the two, just drop the list and state the property
> itself in the default case of the switch. This is a superset of what
> the list matched, the untrusted PTR_TO_MEM does not have to carry
> MEM_RDONLY for it anymore, and it stays in sync with the verifier side
> which uses the same match in save_aux_ptr_type() and reg_type_mismatch_ok().
> 
> Assert that a fault prone type which does not get the rewrite for whatever
> reason is rejected at load time rather than left to fault at runtime to
> catch any future cases.
> 
> Fixes: 1b12171533a9 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref")
> Fixes: 6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier.")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
>  v1 -> v2:
>    - new patch, don't match on full types (Eduard)

Acked-by: Eduard Zingerman <eddyz87@gmail.com>