Re: [PATCH bpf-next v4 1/2] bpf: Enforce trusted BTF ID argument provenance

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Wed Oct 7, 2026 at 6:43 PM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf: check_func_arg() allows PTR_UNTRUSTED | MEM_RCU into KF_RCU kfuncs
> --
>
> commit 1e71cf476e59d8805f3765efcab69f9c9d9bba4a
> Author: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
>
> bpf: Enforce trusted BTF ID argument provenance
>
> This commit modifies the verifier to make the provenance check contract-driven
> by marking generated BTF ID kfunc argument types with PTR_TRUSTED and explicitly
> adding MEM_RCU only for KF_RCU kfuncs. It uses the normalized type for modifier
> checks while reference lookup uses the original register.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 353bde9ae2274..a0ab793f041d8 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>> @@ -9605,8 +9614,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p
>>  			}
>>  		}
>>
>> -		if (is_kfunc(meta) && (!is_trusted_reg(env, reg) ||
>> -				       bpf_type_has_unsafe_modifiers(reg->type))) {
>> +		reg_type = reg->type & ~(arg_type & PTR_MAYBE_NULL);
>> +		if ((arg_type & PTR_TRUSTED) &&
>> +		    (!is_trusted_reg_type(env, reg, reg_type) ||
>> +		     bpf_type_has_unsafe_modifiers(reg_type))) {
>>  			if (!(arg_type & MEM_RCU)) {
> [ ... ]
>>  				return -EINVAL;
>>  			}
>>  			if (!is_rcu_reg(reg)) {
> [ ... ]
>>  				return -EINVAL;
>>  			}
>>  		}
>
> [Severity: High]
> Does this allow a register with both MEM_RCU and PTR_UNTRUSTED modifiers to be
> passed into KF_RCU kfuncs?
>
> If a BPF program loads a pointer that is marked as PTR_UNTRUSTED | MEM_RCU (for
> example, when loading an __rcu pointer embedded in a union) inside an RCU
> critical section, and passes it to a KF_RCU kfunc:
>
> 1. The arg_type has MEM_RCU, so the first inner check !(arg_type & MEM_RCU) is
>    false.
> 2. The register has MEM_RCU, so the second inner check !is_rcu_reg(reg) is
>    false.
> 3. The validation falls through and succeeds, even though the register has the
>    PTR_UNTRUSTED modifier.
>
> Since check_reg_type() bypasses the strict compatible_reg_types check for kfunc
> BTF_ID arguments, this appears to leave the verifier without any checks that
> would reject the untrusted modifier here. Can this result in untrusted garbage
> pointers being used as valid RCU pointers?

Yiyang, could you please follow up with a fix for this corner case as well?
Thanks a lot for the existing fix.