[PATCH bpf-next 0/2] bpf: Fix NULL deref when storing scalar into kptr slot

[PATCH bpf-next 0/2] bpf: Fix NULL deref when storing scalar into kptr slot

[Mykyta Yatsenko]

map_kptr_match_type() accesses reg->btf before confirming the register
is PTR_TO_BTF_ID. A scalar store into a kptr slot has no btf, causing
a NULL pointer dereference. Guard base_type() first.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
Mykyta Yatsenko (2):
      bpf: Fix NULL deref in map_kptr_match_type for scalar regs
      selftests/bpf: Reject scalar store into kptr slot

 kernel/bpf/verifier.c                             |  5 ++++-
 tools/testing/selftests/bpf/progs/map_kptr_fail.c | 15 +++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)
---
base-commit: 009c77e8c29f17614b4f197e08afd91916599dd7
change-id: 20260416-kptr_crash-572ae35c4400

Best regards,
--  
Mykyta Yatsenko <yatsenko@meta.com>

[PATCH bpf-next 1/2] bpf: Fix NULL deref in map_kptr_match_type for scalar regs

[Mykyta Yatsenko]

From: Mykyta Yatsenko <yatsenko@meta.com>

Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
before checking base_type(). A scalar register stored into a kptr
slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
NULL.

Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
access.

Fixes: ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr")
Reported-by: Hiker Cl <clhiker365@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221372
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
 kernel/bpf/verifier.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9e4980128151..a4f3f367988c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4544,6 +4544,9 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
 	int perm_flags;
 	const char *reg_name = "";
 
+	if (base_type(reg->type) != PTR_TO_BTF_ID)
+		goto bad_type;
+
 	if (btf_is_kernel(reg->btf)) {
 		perm_flags = PTR_MAYBE_NULL | PTR_TRUSTED | MEM_RCU;
 
@@ -4556,7 +4559,7 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
 			perm_flags |= MEM_PERCPU;
 	}
 
-	if (base_type(reg->type) != PTR_TO_BTF_ID || (type_flag(reg->type) & ~perm_flags))
+	if (type_flag(reg->type) & ~perm_flags)
 		goto bad_type;
 
 	/* We need to verify reg->type and reg->btf, before accessing reg->btf */

-- 
2.52.0

[PATCH bpf-next 2/2] selftests/bpf: Reject scalar store into kptr slot

[Mykyta Yatsenko]

From: Mykyta Yatsenko <yatsenko@meta.com>

Verify that the verifier rejects a direct scalar write to a kptr map
value slot without crashing.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
 tools/testing/selftests/bpf/progs/map_kptr_fail.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/map_kptr_fail.c b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
index 6443b320c732..ee053b24e6ca 100644
--- a/tools/testing/selftests/bpf/progs/map_kptr_fail.c
+++ b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
@@ -385,4 +385,19 @@ int kptr_xchg_possibly_null(struct __sk_buff *ctx)
 	return 0;
 }
 
+SEC("?tc")
+__failure __msg("invalid kptr access, R")
+int reject_scalar_store_to_kptr(struct __sk_buff *ctx)
+{
+	struct map_value *v;
+	int key = 0;
+
+	v = bpf_map_lookup_elem(&array_map, &key);
+	if (!v)
+		return 0;
+
+	*(volatile u64 *)&v->unref_ptr = 0xBADC0DE;
+	return 0;
+}
+
 char _license[] SEC("license") = "GPL";

-- 
2.52.0

Re: [PATCH bpf-next 1/2] bpf: Fix NULL deref in map_kptr_match_type for scalar regs

[Paul Chaignon]

On Thu, Apr 16, 2026 at 11:08:07AM -0700, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
> 
> Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
> kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
> before checking base_type(). A scalar register stored into a kptr
> slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
> NULL.
> 
> Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
> access.
> 
> Fixes: ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr")
> Reported-by: Hiker Cl <clhiker365@gmail.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221372
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

I believe this should be sent to bpf, not bpf-next (though it currently
applies cleanly to both). With that:

Acked-by: Paul Chaignon <paul.chaignon@gmail.com>

> ---
>  kernel/bpf/verifier.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9e4980128151..a4f3f367988c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4544,6 +4544,9 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
>  	int perm_flags;
>  	const char *reg_name = "";
>  
> +	if (base_type(reg->type) != PTR_TO_BTF_ID)
> +		goto bad_type;
> +
>  	if (btf_is_kernel(reg->btf)) {
>  		perm_flags = PTR_MAYBE_NULL | PTR_TRUSTED | MEM_RCU;
>  
> @@ -4556,7 +4559,7 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
>  			perm_flags |= MEM_PERCPU;
>  	}
>  
> -	if (base_type(reg->type) != PTR_TO_BTF_ID || (type_flag(reg->type) & ~perm_flags))
> +	if (type_flag(reg->type) & ~perm_flags)
>  		goto bad_type;
>  
>  	/* We need to verify reg->type and reg->btf, before accessing reg->btf */
> 
> -- 
> 2.52.0
> 
> 

Re: [PATCH bpf-next 2/2] selftests/bpf: Reject scalar store into kptr slot

[Paul Chaignon]

On Thu, Apr 16, 2026 at 11:08:08AM -0700, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
> 
> Verify that the verifier rejects a direct scalar write to a kptr map
> value slot without crashing.
> 
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

The test makes sense and causes a NULL pointer dereference as expected
when the fix isn't applied.

Acked-by: Paul Chaignon <paul.chaignon@gmail.com>

> ---
>  tools/testing/selftests/bpf/progs/map_kptr_fail.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/map_kptr_fail.c b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
> index 6443b320c732..ee053b24e6ca 100644
> --- a/tools/testing/selftests/bpf/progs/map_kptr_fail.c
> +++ b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
> @@ -385,4 +385,19 @@ int kptr_xchg_possibly_null(struct __sk_buff *ctx)
>  	return 0;
>  }
>  
> +SEC("?tc")
> +__failure __msg("invalid kptr access, R")
> +int reject_scalar_store_to_kptr(struct __sk_buff *ctx)
> +{
> +	struct map_value *v;
> +	int key = 0;
> +
> +	v = bpf_map_lookup_elem(&array_map, &key);
> +	if (!v)
> +		return 0;
> +
> +	*(volatile u64 *)&v->unref_ptr = 0xBADC0DE;
> +	return 0;
> +}
> +
>  char _license[] SEC("license") = "GPL";
> 
> -- 
> 2.52.0
> 
> 

Re: [PATCH bpf-next 0/2] bpf: Fix NULL deref when storing scalar into kptr slot

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu, 16 Apr 2026 11:08:06 -0700 you wrote:
> map_kptr_match_type() accesses reg->btf before confirming the register
> is PTR_TO_BTF_ID. A scalar store into a kptr slot has no btf, causing
> a NULL pointer dereference. Guard base_type() first.
> 
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---
> Mykyta Yatsenko (2):
>       bpf: Fix NULL deref in map_kptr_match_type for scalar regs
>       selftests/bpf: Reject scalar store into kptr slot
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] bpf: Fix NULL deref in map_kptr_match_type for scalar regs
    https://git.kernel.org/bpf/bpf/c/4d0a375887ab
  - [bpf-next,2/2] selftests/bpf: Reject scalar store into kptr slot
    https://git.kernel.org/bpf/bpf/c/fcd11ff8bd0e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH bpf-next 2/2] selftests/bpf: Reject scalar store into kptr slot

[Shung-Hsi Yu]

Cc Ihor since BPF CI should be able to remove map_kptr from deny list
once this is fixed.

On Fri, Apr 17, 2026 at 12:20:06AM +0200, Paul Chaignon wrote:
> On Thu, Apr 16, 2026 at 11:08:08AM -0700, Mykyta Yatsenko wrote:
...
> > +SEC("?tc")
> > +__failure __msg("invalid kptr access, R")
> > +int reject_scalar_store_to_kptr(struct __sk_buff *ctx)
> > +{
> > +	struct map_value *v;
> > +	int key = 0;
> > +
> > +	v = bpf_map_lookup_elem(&array_map, &key);
> > +	if (!v)
> > +		return 0;
> > +
> > +	*(volatile u64 *)&v->unref_ptr = 0xBADC0DE;
> > +	return 0;
> > +}
> > +
...

With test_progs-cpuv4 the error was slightly different due to the use of
BPF_ST instead of BPF_STX, and thus this test will fail due to
mismatched error message:

  run_subtest:PASS:obj_open_mem 0 nsec
  libbpf: prog 'reject_scalar_store_to_kptr': BPF program load failed: -EACCES
  libbpf: prog 'reject_scalar_store_to_kptr': failed to load: -EACCES
  libbpf: failed to load object 'map_kptr_fail'
  run_subtest:PASS:unexpected_load_success 0 nsec
  validate_msgs:FAIL:934 expect_msg
  VERIFIER LOG:
  =============
  0: R1=ctx() R10=fp0
  ; int key = 0; @ map_kptr_fail.c:393
  0: (62) *(u32 *)(r10 -4) = 0          ; R10=fp0 fp-8=0000????
  1: (bf) r2 = r10                      ; R2=fp0 R10=fp0
  2: (07) r2 += -4                      ; R2=fp-4
  ; v = bpf_map_lookup_elem(&array_map, &key); @ map_kptr_fail.c:395
  3: (18) r1 = 0xffff8ddd0bb76c00       ; R1=map_ptr(map=array_map,ks=4,vs=32)
  5: (85) call bpf_map_lookup_elem#1    ; R0=map_value(map=array_map,ks=4,vs=32)
  ; if (!v) @ map_kptr_fail.c:396
  6: (15) if r0 == 0x0 goto pc+1        ; R0=map_value(map=array_map,ks=4,vs=32)
  ; *(volatile u64 *)&v->unref_ptr = 0xBADC0DE; @ map_kptr_fail.c:399
  7: (7a) *(u64 *)(r0 +8) = 195936478
  BPF_ST imm must be 0 when storing to kptr at off=8
  processed 7 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
  =============
  EXPECTED   SUBSTR: 'invalid kptr access, R'
  #214/20  map_kptr/reject_scalar_store_to_kptr:FAIL

Note: currently BPF CI does not test map_kptr due to it being in the
denylist.