[PATCH 6.6.y] bpf: Check the helper function is valid in get_helper_proto

[PATCH 6.6.y] bpf: Check the helper function is valid in get_helper_proto

[Artem Dinaburg]

From: Jiri Olsa <olsajiri@gmail.com>

[ Upstream commit e4414b01c1cd9887bbde92f946c1ba94e40d6d64 ]

kernel test robot reported verifier bug [1] where the helper func
pointer could be NULL due to disabled config option.

As Alexei suggested we could check on that in get_helper_proto
directly. Marking tail_call helper func with BPF_PTR_POISON,
because it is unused by design.

  [1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com

Reported-by: kernel test robot <oliver.sang@intel.com>
Reported-by: syzbot+a9ed3d9132939852d0df@syzkaller.appspotmail.com
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Paul Chaignon <paul.chaignon@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20250814200655.945632-1-jolsa@kernel.org
Closes: https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com
Assisted-by: LLM
[ Backport to 6.6.y: Apply the function-pointer validity check in
  check_helper_call(), because this target has no get_helper_proto().
  Refer to the target get_func_proto() callback in the tail-call comment.
  ]
Signed-off-by: Artem Dinaburg <artem@trailofbits.com>
---
Hi,

Please consider this backport of the fix for CVE-2025-39990 to 6.6.y.

The helper-validity check is applied in check_helper_call() and its
comment names the target get_func_proto() callback. See the bracketed
backport note above.

The complete fix is already present in 6.12.y, 6.18.y and 7.2.y.

Build-tested only as part of a cumulative 6.6.y series on x86_64
(allmodconfig, CONFIG_WERROR=y); no runtime testing.

Thanks,
Artem Dinaburg

 kernel/bpf/core.c     |    5 ++++-
 kernel/bpf/verifier.c |    2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 9fa984ee076bccbf5e90eb6a194cec68f2351200..bec8876f12375bbbe00d8cbe5ee7d410e48ecd88 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2959,7 +2959,10 @@ EXPORT_SYMBOL_GPL(bpf_event_output);
 
 /* Always built-in helper functions. */
 const struct bpf_func_proto bpf_tail_call_proto = {
-	.func		= NULL,
+	/* func is unused for tail_call, we set it to pass the
+	 * get_func_proto check
+	 */
+	.func		= BPF_PTR_POISON,
 	.gpl_only	= false,
 	.ret_type	= RET_VOID,
 	.arg1_type	= ARG_PTR_TO_CTX,
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 778a68bfb91dd4e765252cfb1bacb4b658d1381b..a72e1561464cb94942afa723e57c76f032d30dc0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10091,7 +10091,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 
 	if (env->ops->get_func_proto)
 		fn = env->ops->get_func_proto(func_id, env->prog);
-	if (!fn) {
+	if (!fn || !fn->func) {
 		verbose(env, "unknown func %s#%d\n", func_id_name(func_id),
 			func_id);
 		return -EINVAL;

Re: [PATCH 6.6.y] bpf: Check the helper function is valid in get_helper_proto

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: multi-line comment style violation in bpf_tail_call_proto
--

commit f05c559892f9e9f36efa93c44d19d9d526404f49
Author: Jiri Olsa <olsajiri@gmail.com>

bpf: Check the helper function is valid in get_helper_proto

This commit adds a check in check_helper_call() to ensure the helper function
pointer is not NULL, preventing a verifier bug when config options are disabled.
It also sets the unused tail_call helper function to BPF_PTR_POISON.

Link: https://lore.kernel.org/bpf/20250814200655.945632-1-jolsa@kernel.org

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 9fa984ee076bc..bec8876f12375 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -2959,7 +2959,10 @@ EXPORT_SYMBOL_GPL(bpf_event_output);
>  
>  /* Always built-in helper functions. */
>  const struct bpf_func_proto bpf_tail_call_proto = {
> -	.func		= NULL,
> +	/* func is unused for tail_call, we set it to pass the
> +	 * get_func_proto check
> +	 */

[Severity: Low]
This isn't a bug, but does this multi-line comment follow the BPF subsystem's
formatting rules? It seems the opening /* should be on its own line, with the
comment text starting on the next line.

> +	.func		= BPF_PTR_POISON,
>  	.gpl_only	= false,
>  	.ret_type	= RET_VOID,
>  	.arg1_type	= ARG_PTR_TO_CTX,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016022203.17034-1-artem@trailofbits.com?part=1