Re: [PATCH bpf 1/2] bpf: Fix NULL-ptr-deref when dumping a key-less BTF hash map

[Jiayuan Chen <jiayuan.chen@linux.dev>]

on 8/28/26 5:54 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] btf_modifier_show dereferences NULL when a modifier resolves to a void type.
> --
>
> commit 36dc7c26f56375bd142801da1fcbc83e4a765c35
> Author: Jiayuan Chen <jiayuan.chen@linux.dev>
>
> bpf: Fix NULL-ptr-deref when dumping a key-less BTF hash map
>      
> This patch fixes a NULL pointer dereference in btf_type_show() that occurs
> when dumping a key-less BTF hash map. It restores previous behavior by
> rejecting key-less BTF in hash map check callbacks, and adds a NULL check
> for void types in btf_type_show() to gracefully handle any other paths.
>
> Reported-by: syzbot+37b56485bbbf90ad8489@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6a8f4e88.27659fcc.2ceef7.0008.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>
>> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>> index da36d4b9d31ab..c32265dc4ae7e 100644
>> --- a/kernel/bpf/btf.c
>> +++ b/kernel/bpf/btf.c
>> @@ -8229,6 +8229,10 @@ static void btf_type_show(const struct btf *btf, u32 type_id, void *obj,
>>   	memset(&show->state, 0, sizeof(show->state));
>>   	memset(&show->obj, 0, sizeof(show->obj));
>>   
>> +	/* A void type (e.g. type_id 0) has no show op, don't deref NULL. */
>> +	if (!t || !btf_type_ops(t))
>> +		return;
>> +
>>   	btf_type_ops(t)->show(btf, t, type_id, obj, 0, show);
>>   }
> [Severity: High]
> This is a pre-existing issue, but does this fix need to be extended to
> btf_modifier_show() as well?
>
> If a user with BPF tracing privileges invokes the bpf_snprintf_btf() helper
> with a btf_id of a modifier that points to void (e.g., const void),
> btf_type_show() will see the modifier type and pass this check since
> modifier_ops is not NULL.


Right, good catch. Passing a "const void" type_id to bpf_snprintf_btf() 
resolves to

void in btf_modifier_show() and hits the same NULL deref, which the 
check here does not cover.

Shoud I add the fix in this patchset since they are all about "show" 
semantics‌?