Re: [PATCH bpf v2 2/2] bpf: Reject untrusted pointers in refcount_acquire

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Mon Aug 3, 2026 at 9:10 AM CEST, Ning Ding wrote:
>> It will work, you can test it yourself. Reads on PTR_UNTRUSTED is fine, it gets
>> handled by the BPF_PROBE_MEM loads, which handle use-after-free safely.
>
> But if we apply the one-line change to type_is_ptr_alloc_obj(), the
> read-only test I added will be rejected. SInce the read will hit that
> code block and trigger the allocated object must have a referenced
> id".
> if (type_is_alloc(reg->type) &&
>     !type_is_non_owning_ref(reg->type) &&
>     !(reg->type & MEM_RCU) &&
>     !reg_is_referenced(env, reg)) {
> verifier_bug(env, "allocated object must have a referenced id");
> return -EFAULT;
> }

We can make a specific exception in this case IMO. That is easier to reason
about than allowing it by default everywhere. We can even add a comment about
it.

>
> There are 2 possible solutions:
> 1. Split the type_is_ptr_alloc_obj into 2 helpers, one is only
> checking whether the pointer has PTR_TO_BTF_ID | MEM_ALLOC, the other
> one checks if it is also trusted:
> static inline bool type_is_any_ptr_alloc_obj(u32 type)
> {
> return base_type(type) == PTR_TO_BTF_ID &&
>        type_flag(type) & MEM_ALLOC;
> }
> static inline bool type_is_ptr_alloc_obj(u32 type)
> {
> return type_is_any_ptr_alloc_obj(type) &&
>        !(type_flag(type) & PTR_UNTRUSTED);
> }

I would just create another more specific type_is_untrusted_ptr_alloc_obj().
Tighten existing type_is_ptr_alloc_obj() to exclude untrusted case.

Then just add "&& !type_is_untrusted_ptr_alloc_obj(...)" to the list of existing
checks before the error you pointed out above.

In addition, I would add a comment saying that the BPF_WRITE case for the
type_is_untrusted_ptr_alloc_obj() types was already rejected earlier, so this
check only permits reads on them.

Then the test you mentioned should continue passing.

> reg_btf_record() will use type_is_any_ptr_alloc_obj since it only
> looks up metadata, while bpf_refcount_acquire should use
> type_is_ptr_alloc_obj.

Is reg_btf_record() going to ever get such a pointer as input? From my cursory
look that doesn't seem so. It was happening before since such pointers could be
passed around to helpers or kfuncs. That should not be the case anymore.

>
> 3. Keep the untrusted pointer check on top like the current patch.