Re: [PATCH bpf-next 1/2] bpf: Fix NULL deref in map_kptr_match_type for scalar regs

[Paul Chaignon <paul.chaignon@gmail.com>]

On Thu, Apr 16, 2026 at 11:08:07AM -0700, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
> 
> Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
> kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
> before checking base_type(). A scalar register stored into a kptr
> slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
> NULL.
> 
> Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
> access.
> 
> Fixes: ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr")
> Reported-by: Hiker Cl <clhiker365@gmail.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221372
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

I believe this should be sent to bpf, not bpf-next (though it currently
applies cleanly to both). With that:

Acked-by: Paul Chaignon <paul.chaignon@gmail.com>

> ---
>  kernel/bpf/verifier.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9e4980128151..a4f3f367988c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4544,6 +4544,9 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
>  	int perm_flags;
>  	const char *reg_name = "";
>  
> +	if (base_type(reg->type) != PTR_TO_BTF_ID)
> +		goto bad_type;
> +
>  	if (btf_is_kernel(reg->btf)) {
>  		perm_flags = PTR_MAYBE_NULL | PTR_TRUSTED | MEM_RCU;
>  
> @@ -4556,7 +4559,7 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
>  			perm_flags |= MEM_PERCPU;
>  	}
>  
> -	if (base_type(reg->type) != PTR_TO_BTF_ID || (type_flag(reg->type) & ~perm_flags))
> +	if (type_flag(reg->type) & ~perm_flags)
>  		goto bad_type;
>  
>  	/* We need to verify reg->type and reg->btf, before accessing reg->btf */
> 
> -- 
> 2.52.0
> 
>