Re: [PATCH bpf-next v1 02/10] bpf: Recognize __nullable on pointer members of kernel structs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: MEM_RCU map pointers bypass PROBE_MEM and NULL checks
--

commit cd9a005edc33a27f4ea8950cfa7c36fe9d72a985
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Recognize __nullable on pointer members of kernel structs

This patch teaches the BPF verifier to recognize the __nullable BTF type tag
on pointer members of kernel structs, assigning them the PTR_MAYBE_NULL flag.
The flag is kept on trusted and RCU pointers, forcing BPF programs to
explicitly check them before use.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 2f190abe34489..70fd44a6e1c56 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -6785,6 +6792,8 @@ static int check_ptr_to_map_access(struct bpf_verifier_env *env,
>  	ret = btf_struct_access(&env->log, &map_reg, off, size, atype, &btf_id, &flag, NULL);
>  	if (ret < 0)
>  		return ret;
> +	/* Nothing walked from a map is trusted, a __nullable member changes nothing. */
> +	flag &= ~PTR_MAYBE_NULL;
        ^^^^^^^^^^^^^^^^^^^^^^^^

[Severity: High]
Does stripping PTR_MAYBE_NULL here allow MEM_RCU map pointers to bypass both
PROBE_MEM and NULL checks?

When a CAP_PERFMON BPF program reads an __rcu-tagged pointer field from a map
structure (e.g., trie->root in struct lpm_trie), btf_struct_access() evaluates
the tag and returns MEM_RCU in flag.

If we explicitly clear PTR_MAYBE_NULL here without clearing MEM_RCU or adding
PTR_UNTRUSTED, the verifier assigns PTR_TO_BTF_ID | MEM_RCU to the destination
register.

Since bpf_may_fault_on_deref(PTR_TO_BTF_ID | MEM_RCU) evaluates to false (as it
expects exactly PTR_TO_BTF_ID or the PTR_UNTRUSTED flag), the load is not
rewritten to BPF_PROBE_MEM. Because PTR_MAYBE_NULL was stripped, the verifier
will permit the dereference without a NULL check.

At runtime, reading from a NULL pointer (like a NULL trie->root) would then
perform a bare memory load and crash the kernel. Does this active stripping
prevent the new __nullable tag from protecting these vulnerable pointers?

>  
>  	if (value_regno >= 0) {
>  		ret = mark_btf_ld_reg(env, regs, value_regno, ret, btf_vmlinux, btf_id, flag);
>  		if (ret < 0)
>  			return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012133711.4030594-1-memxor@gmail.com?part=2