Re: [PATCH bpf-next v2 04/13] bpf: Recognize __nullable on pointer members of kernel structs

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Tue Oct 13, 2026 at 10:52 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf: MEM_PERCPU pointers are stripped of PTR_MAYBE_NULL flag causing Oops
> --
>
> commit 2e4273929b840decae1764fc52e2d82686a2b6c3
> Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
>
> bpf: Recognize __nullable on pointer members of kernel structs
>
> This patch updates btf_struct_walk() to report the __nullable BTF type tag
> on pointer members as PTR_MAYBE_NULL. The verifier is also modified to keep
> the PTR_MAYBE_NULL flag on trusted and RCU pointers only, under the
> assumption that untrusted results are probed anyway.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 2f190abe34489..a9c47441fba91 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>
> [ ... ]
>
>> @@ -6721,6 +6721,13 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
>>  		clear_trusted_flags(&flag);
>>  	}
>>
>> +	/*
>> +	 * A __nullable member only matters where NULL would otherwise be
>> +	 * assumed away, on trusted and RCU pointers; the rest are probed.
>> +	 */
>> +	if (!(flag & (PTR_TRUSTED | MEM_RCU)))
>> +		flag &= ~PTR_MAYBE_NULL;
>> +
>
> [Severity: High]
> Does this unintentionally strip the NULL-checking requirement from
> MEM_PERCPU pointers?
>
> Struct members annotated with __percpu __nullable will receive the
> MEM_PERCPU | PTR_MAYBE_NULL flags from btf_struct_walk(), but lack
> PTR_TRUSTED or MEM_RCU.
>
> Because the pointer loses PTR_MAYBE_NULL here, does the BPF verifier no
> longer force the BPF program to verify it against NULL before passing it to
> helpers like bpf_per_cpu_ptr() or bpf_this_cpu_ptr()?
>
> Since these helpers do not check for NULL internally, calling them with NULL
> simply returns the base address of the CPU's per-CPU memory area. A
> subsequent NULL check by the BPF program would then pass, which might allow
> it to dereference the base of the per-CPU area and corrupt memory.
>

Will just drop the stripping logic, I don't think it makes too much sense and
code is simpler without it.

>>  	if (atype == BPF_READ && value_regno >= 0) {
>>  		ret = mark_btf_ld_reg(env, regs, value_regno, ret, reg->btf, btf_id, flag);
>>  		if (ret < 0)