Re: [PATCH RFC 1/2] bpf: fix UAF via trusted BTF walk after release

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Wed Sep 16, 2026 at 8:33 PM CEST, Chris Mason wrote:
> A BPF program can keep dereferencing a trusted pointer that it loaded
> from a referenced object after it has released that reference. With a
> file from bpf_get_task_exe_file(), f->f_inode stays usable after
> bpf_put_file(), and loads through it read freed or reused inode memory.
>
> A pointer derived from a referenced object is only valid while the
> reference is held. release_reference() enforces that by invalidating
> every register whose id or parent_id matches the released id. However,
> check_ptr_to_btf_access() builds the loaded register with
> mark_btf_ld_reg(), which is not given the source register and zeroes
> both fields. The verifier state for the f_inode case:
>
>     file = bpf_get_task_exe_file(task)   file:  id=N, referenced
>     inode = file->f_inode                inode: trusted, id=0,
>                                                 parent_id=0
>     bpf_put_file(file)                   release_reference(N)
>                                            skips inode
>     inode->i_ino                         accepted, unprobed load
>
> Reproduced by reading inode->i_ino after bpf_put_file() once the task
> owning the file had exited and new fds were created.
>
> Fix this by recording the source's reference id in the parent_id of a
> trusted PTR_TO_BTF_ID load. A program that dereferences such a pointer
> after the release is now rejected with "invalid mem access 'scalar'".
>
> Assisted-by: kres
> Fixes: 57539b1c0ac2 ("bpf: Enable annotating trusted nested pointers")
> Signed-off-by: Chris Mason <mason@kernel.org>
> ---

Thanks for the report. I have a fix for this locally in the queue. The diagnosis
is correct, but there are more places that would require changes. For instance,
bpf_real_data_inode() should, but does not, propagate the lifetime of the input
argument to the returned inode. That would require some sort of annotation so
that we are aware of the lifetime relationship between the input and the
returned pointer.

I will send it out and will handle this case as well.