[PATCH bpf-next v1 0/4] bpf: bound trusted fields to their parent's lifetime

[PATCH bpf-next v1 0/4] bpf: bound trusted fields to their parent's lifetime

[Justin Suess]

Howdy folks,

Two fixes to the lifetime of trusted fields.

A field in the __safe_trusted or __safe_trusted_or_null sets becomes
PTR_TRUSTED regardless of how its parent is kept alive: nothing ties
the resulting pointer to its parent's lifetime. There are two separate
cases, RCU-protected parents and referenced parents.

First, an RCU-protected parent, e.g. mm->exe_file read under
bpf_rcu_read_lock(), is MEM_RCU. It can hand out file->f_inode as
fully trusted, and the inode pointer survives bpf_rcu_read_unlock().
It remains dereferenceable without PROBE_MEM and passable to kfuncs
expecting trusted arguments after the grace period.

Second, a referenced parent has the same lifetime problem with release
kfuncs. A trusted field walked out of an acquired object stays usable
even after the reference to its parent is dropped. An in-tree example:
the file acquired from bpf_get_task_exe_file() is released at
bpf_put_file(), but an f_inode taken out of it stays trusted after the
object may be freed.

Fix both by making the walked field inherit its parent's bound.
Patch 1 substitutes MEM_RCU for PTR_TRUSTED when the parent is
MEM_RCU, so the field is invalidated with the critical section like
every other RCU pointer. Patch 3 sets the walked field's parent_id to
the parent's reference. Programs that relied on either escape will no
longer load, but the behavior they relied on was essentially a
use-after-free being papered over with deferred free mechanisms and
refcounts held outside BPF.

Patches 2 and 4 add reject and accept selftests for each.

Justin

Justin Suess (4):
  bpf: Carry MEM_RCU for trusted fields with MEM_RCU parents
  selftests/bpf: Test MEM_RCU carry-over for trusted fields
  bpf: Bind trusted fields to their parent's reference
  selftests/bpf: Test trusted-field invalidation on parent release

 kernel/bpf/verifier.c                         | 11 ++++-
 .../selftests/bpf/progs/verifier_vfs_accept.c | 40 +++++++++++++++
 .../selftests/bpf/progs/verifier_vfs_reject.c | 49 +++++++++++++++++++
 3 files changed, 98 insertions(+), 2 deletions(-)


base-commit: 763187dbbf83764a57d5811168ef9de7b9a60e2d
-- 
2.55.0

[PATCH bpf-next v1 1/4] bpf: Carry MEM_RCU for trusted fields with MEM_RCU parents

[Justin Suess]

Substitute MEM_RCU instead of PTR_TRUSTED for fields declared as trusted
when the parent pointer is MEM_RCU.

Today, walking a field in the __safe_trusted or __safe_trusted_or_null
set invariably yields PTR_TRUSTED if its parent is trusted. If the
parent is instead RCU protected, the resulting pointer survives
bpf_rcu_read_unlock() as fully trusted: it can be dereferenced without
PROBE_MEM and passed to kfuncs expecting trusted arguments after the
parent's RCU grace period, e.g. mm->exe_file (MEM_RCU) followed by
file->f_inode escapes the RCU CS as a trusted inode. Limit the child
field's lifetime to that of the parent.

Fixes: 6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier.")
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
 kernel/bpf/verifier.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 2f190abe3448..20ca8591a0fe 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6684,9 +6684,9 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 		 * trusted if we are in an RCU CS. Such pointer can be NULL.
 		 */
 		if (type_is_trusted(env, reg, field_name, btf_id)) {
-			flag |= PTR_TRUSTED;
+			flag |= is_rcu_reg(reg) ? MEM_RCU : PTR_TRUSTED;
 		} else if (type_is_trusted_or_null(env, reg, field_name, btf_id)) {
-			flag |= PTR_TRUSTED | PTR_MAYBE_NULL;
+			flag |= (is_rcu_reg(reg) ? MEM_RCU : PTR_TRUSTED) | PTR_MAYBE_NULL;
 		} else if (in_rcu_cs(env) && !type_may_be_null(reg->type)) {
 			if (type_is_rcu(env, reg, field_name, btf_id)) {
 				/* ignore __rcu tag and mark it MEM_RCU */
-- 
2.55.0

[PATCH bpf-next v1 2/4] selftests/bpf: Test MEM_RCU carry-over for trusted fields

[Justin Suess]

Walking file->f_inode out of an RCU-protected mm->exe_file must yield an
RCU pointer rather than a trusted one. Add a reject test where the inode
is used as a trusted argument after bpf_rcu_read_unlock() and an accept
test where it is dereferenced inside the RCU critical section.

Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
 .../selftests/bpf/progs/verifier_vfs_accept.c | 23 ++++++++++++++
 .../selftests/bpf/progs/verifier_vfs_reject.c | 30 +++++++++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
index 55398c04290a..f519ba5f4ea2 100644
--- a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
+++ b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
@@ -100,4 +100,27 @@ int BPF_PROG(inode_rename, struct inode *old_dir, struct dentry *old_dentry,
 	return 0;
 }
 
+SEC("lsm.s/bprm_committed_creds")
+__success
+int BPF_PROG(trusted_field_used_in_rcu_cs, struct linux_binprm *bprm)
+{
+	struct mm_struct *mm = bprm->mm;
+	struct inode *inode;
+	struct file *file;
+	ino_t ino = 0;
+
+	if (!mm)
+		return 0;
+
+	bpf_rcu_read_lock();
+	file = mm->exe_file;
+	if (file) {
+		inode = file->f_inode;
+		ino = inode->i_ino;
+	}
+	bpf_rcu_read_unlock();
+	__sink(ino);
+	return 0;
+}
+
 char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c b/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c
index b5f456d57669..b71ef8ac1798 100644
--- a/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c
+++ b/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c
@@ -173,4 +173,34 @@ int BPF_PROG(inode_rename, struct inode *old_dir, struct dentry *old_dentry,
 		return -EACCES;
 	return 0;
 }
+
+__weak int subprog_trusted_inode(struct inode *inode __arg_trusted)
+{
+	return inode->i_ino;
+}
+
+SEC("lsm.s/bprm_committed_creds")
+__failure __msg("R1 type=untrusted_ptr_ expected=ptr_, trusted_ptr_, rcu_ptr_")
+int BPF_PROG(trusted_field_escapes_rcu_cs, struct linux_binprm *bprm)
+{
+	struct mm_struct *mm = bprm->mm;
+	struct inode *inode;
+	struct file *file;
+
+	if (!mm)
+		return 0;
+
+	bpf_rcu_read_lock();
+	file = mm->exe_file;
+	if (!file) {
+		bpf_rcu_read_unlock();
+		return 0;
+	}
+	inode = file->f_inode;
+	bpf_rcu_read_unlock();
+
+	/* inode inherited MEM_RCU from file and is untrusted after unlock. */
+	subprog_trusted_inode(inode);
+	return 0;
+}
 char _license[] SEC("license") = "GPL";
-- 
2.55.0

[PATCH bpf-next v1 3/4] bpf: Bind trusted fields to their parent's reference

[Justin Suess]

A field in the __safe_trusted or __safe_trusted_or_null set walked out
of a referenced parent yields PTR_TRUSTED with nothing tying it to the
reference that keeps it alive. Releasing the parent invalidates the
parent's own register but not the walked field, which stays fully
trusted after the object may already be freed:

	file = bpf_get_task_exe_file(task);	/* acquired */
	inode = file->f_inode;			/* __safe_trusted */
	bpf_put_file(file);			/* inode stays trusted */

Set the walked field's parent_id to the parent's reference id, or to
the parent's own parent_id so a chain of derived fields stays bound to
the original reference. release_reference() already invalidates every
register whose parent_id matches, recursively, and regsafe() already
maps parent_id through check_ids(), so no other verifier changes are
needed. An RCU-protected parent keeps bounding its fields to the RCU
critical section through MEM_RCU instead.

Fixes: 6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier.")
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
 kernel/bpf/verifier.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 20ca8591a0fe..8c39ec2ff408 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6562,6 +6562,7 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 	const char *tname = btf_name_by_offset(reg->btf, t->name_off);
 	const char *field_name = NULL;
 	enum bpf_type_flag flag = 0;
+	u32 parent_id = 0;
 	u32 btf_id = 0;
 	s64 min_off;
 	int ret;
@@ -6716,6 +6717,11 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 			 */
 			flag = PTR_UNTRUSTED;
 		}
+
+		/* A trusted field is pinned by whatever pins its parent. */
+		if (flag & PTR_TRUSTED)
+			parent_id = reg_is_referenced(env, reg) ? reg->id :
+								  reg->parent_id;
 	} else {
 		/* Old compat. Deprecated */
 		clear_trusted_flags(&flag);
@@ -6725,6 +6731,7 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 		ret = mark_btf_ld_reg(env, regs, value_regno, ret, reg->btf, btf_id, flag);
 		if (ret < 0)
 			return ret;
+		regs[value_regno].parent_id = parent_id;
 	}
 
 	return 0;
-- 
2.55.0

[PATCH bpf-next v1 4/4] selftests/bpf: Test trusted-field invalidation on parent release

[Justin Suess]

Walking file->f_inode out of an acquired file must not outlive
bpf_put_file(). Add a reject test where the inode is used as a trusted
argument after the file's reference is released and an accept test
where it is read before.

Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
 .../selftests/bpf/progs/verifier_vfs_accept.c | 17 +++++++++++++++++
 .../selftests/bpf/progs/verifier_vfs_reject.c | 19 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
index f519ba5f4ea2..d7e4fc658fea 100644
--- a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
+++ b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
@@ -123,4 +123,21 @@ int BPF_PROG(trusted_field_used_in_rcu_cs, struct linux_binprm *bprm)
 	return 0;
 }
 
+SEC("lsm.s/file_open")
+__success
+int BPF_PROG(trusted_field_used_before_put)
+{
+	struct task_struct *task = bpf_get_current_task_btf();
+	struct file *file = bpf_get_task_exe_file(task);
+	ino_t ino;
+
+	if (!file)
+		return 0;
+
+	ino = file->f_inode->i_ino;
+	bpf_put_file(file);
+	__sink(ino);
+	return 0;
+}
+
 char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c b/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c
index b71ef8ac1798..c35cf9800f0f 100644
--- a/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c
+++ b/tools/testing/selftests/bpf/progs/verifier_vfs_reject.c
@@ -203,4 +203,23 @@ int BPF_PROG(trusted_field_escapes_rcu_cs, struct linux_binprm *bprm)
 	subprog_trusted_inode(inode);
 	return 0;
 }
+
+SEC("lsm.s/file_open")
+__failure __msg("R1 type=scalar expected=ptr_, trusted_ptr_, rcu_ptr_")
+int BPF_PROG(trusted_field_outlives_parent_reference)
+{
+	struct task_struct *task = bpf_get_current_task_btf();
+	struct file *file = bpf_get_task_exe_file(task);
+	struct inode *inode;
+
+	if (!file)
+		return 0;
+
+	inode = file->f_inode;
+	bpf_put_file(file);
+
+	/* inode was pinned by file's reference and died with it. */
+	subprog_trusted_inode(inode);
+	return 0;
+}
 char _license[] SEC("license") = "GPL";
-- 
2.55.0

Re: [PATCH bpf-next v1 2/4] selftests/bpf: Test MEM_RCU carry-over for trusted fields

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: unhandled NULL deref of f_inode due to SLAB_TYPESAFE_BY_RCU
--

commit 3b6fbe50569bfdf0fb6b88ab1c38f2e6056c0f68
Author: Justin Suess <utilityemal77@gmail.com>

selftests/bpf: Test MEM_RCU carry-over for trusted fields

This commit adds selftests to verify the behavior of the BPF verifier when
accessing fields from RCU-protected pointers. It includes an accept test
for dereferencing an inode within an RCU critical section, and a reject test
for using it after the critical section ends.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
> index 55398c04290a8..f519ba5f4ea20 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
[ ... ]
> +SEC("lsm.s/bprm_committed_creds")
> +__success
> +int BPF_PROG(trusted_field_used_in_rcu_cs, struct linux_binprm *bprm)
> +{
> +	struct mm_struct *mm = bprm->mm;
> +	struct inode *inode;
> +	struct file *file;
> +	ino_t ino = 0;
> +
> +	if (!mm)
> +		return 0;
> +
> +	bpf_rcu_read_lock();
> +	file = mm->exe_file;
> +	if (file) {
> +		inode = file->f_inode;
> +		ino = inode->i_ino;

[Severity: High]
Can this result in an unhandled NULL pointer dereference leading to a
kernel Oops?

Because struct file is allocated with SLAB_TYPESAFE_BY_RCU in files_init() 
in fs/file_table.c, the file object can be concurrently freed and reallocated
while an RCU reader holds a pointer to it. During this reallocation process,
alloc_empty_file() calls init_file(), which zeroes out f_inode.

In check_ptr_to_btf_access() in the verifier, the PTR_MAYBE_NULL flag is omitted
for trusted fields read from MEM_RCU pointers. This prevents the verifier from
enforcing a NULL check on the resulting inode pointer. Additionally, the
dereference bypasses the exception table rewrite that would normally handle
memory faults for untrusted pointers.

If a file is closed and reallocated concurrently while the BPF program runs,
could inode be NULL when inode->i_ino is accessed? Is it safe to codify this
pattern as an accept test without requiring a NULL check for f_inode?

> +	}
> +	bpf_rcu_read_unlock();
> +	__sink(ino);
> +	return 0;
> +}
> +
>  char _license[] SEC("license") = "GPL";

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014173039.3666415-1-utilityemal77@gmail.com?part=2

Re: [PATCH bpf-next v1 2/4] selftests/bpf: Test MEM_RCU carry-over for trusted fields

[Justin Suess]

On Wed, Oct 14, 2026 at 05:43:34PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf: unhandled NULL deref of f_inode due to SLAB_TYPESAFE_BY_RCU
> --
> 
> commit 3b6fbe50569bfdf0fb6b88ab1c38f2e6056c0f68
> Author: Justin Suess <utilityemal77@gmail.com>
> 
> selftests/bpf: Test MEM_RCU carry-over for trusted fields
> 
> This commit adds selftests to verify the behavior of the BPF verifier when
> accessing fields from RCU-protected pointers. It includes an accept test
> for dereferencing an inode within an RCU critical section, and a reject test
> for using it after the critical section ends.
> 
> > diff --git a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
> > index 55398c04290a8..f519ba5f4ea20 100644
> > --- a/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
> > +++ b/tools/testing/selftests/bpf/progs/verifier_vfs_accept.c
> [ ... ]
> > +SEC("lsm.s/bprm_committed_creds")
> > +__success
> > +int BPF_PROG(trusted_field_used_in_rcu_cs, struct linux_binprm *bprm)
> > +{
> > +	struct mm_struct *mm = bprm->mm;
> > +	struct inode *inode;
> > +	struct file *file;
> > +	ino_t ino = 0;
> > +
> > +	if (!mm)
> > +		return 0;
> > +
> > +	bpf_rcu_read_lock();
> > +	file = mm->exe_file;
> > +	if (file) {
> > +		inode = file->f_inode;
> > +		ino = inode->i_ino;
> 
> [Severity: High]
> Can this result in an unhandled NULL pointer dereference leading to a
> kernel Oops?
>
No because this test never executes. It's a verifier load selftest.

Justin
> Because struct file is allocated with SLAB_TYPESAFE_BY_RCU in files_init() 
> in fs/file_table.c, the file object can be concurrently freed and reallocated
> while an RCU reader holds a pointer to it. During this reallocation process,
> alloc_empty_file() calls init_file(), which zeroes out f_inode.
> 
> In check_ptr_to_btf_access() in the verifier, the PTR_MAYBE_NULL flag is omitted
> for trusted fields read from MEM_RCU pointers. This prevents the verifier from
> enforcing a NULL check on the resulting inode pointer. Additionally, the
> dereference bypasses the exception table rewrite that would normally handle
> memory faults for untrusted pointers.
> 
> If a file is closed and reallocated concurrently while the BPF program runs,
> could inode be NULL when inode->i_ino is accessed? Is it safe to codify this
> pattern as an accept test without requiring a NULL check for f_inode?
>
> > +	}
> > +	bpf_rcu_read_unlock();
> > +	__sink(ino);
> > +	return 0;
> > +}
> > +
> >  char _license[] SEC("license") = "GPL";
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261014173039.3666415-1-utilityemal77@gmail.com?part=2