* [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a global subprog
@ 2026-07-23 22:18 Amery Hung
2026-07-23 22:18 ` [PATCH bpf v2 2/2] selftests/bpf: Test passing scalar NULL to nonnull " Amery Hung
2026-07-23 23:20 ` [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a " patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Amery Hung @ 2026-07-23 22:18 UTC (permalink / raw)
To: bpf
Cc: alexei.starovoitov, andrii, daniel, eddyz87, memxor, ameryhung,
kernel-team
A global subprogram argument tagged __arg_nonnull is set up as a
non-nullable PTR_TO_MEM. However the verifier does not check against a
scalar NULL, leading to real NULL pointer dereference. Reject it as
well.
Fixes: 94e1c70a3452 ("bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args")
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Amery Hung <ameryhung@gmail.com>
---
kernel/bpf/verifier.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 99444eae917e..7aa47342dc65 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9189,7 +9189,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
return ret;
if (check_mem_reg(env, reg, argno, arg->mem_size))
return -EINVAL;
- if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) {
+ if (!(arg->arg_type & PTR_MAYBE_NULL) &&
+ (type_may_be_null(reg->type) || bpf_register_is_null(reg))) {
bpf_log(log, "%s is expected to be non-NULL\n",
reg_arg_name(env, argno));
return -EINVAL;
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH bpf v2 2/2] selftests/bpf: Test passing scalar NULL to nonnull global subprog
2026-07-23 22:18 [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a global subprog Amery Hung
@ 2026-07-23 22:18 ` Amery Hung
2026-07-23 23:20 ` [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a " patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Amery Hung @ 2026-07-23 22:18 UTC (permalink / raw)
To: bpf
Cc: alexei.starovoitov, andrii, daniel, eddyz87, memxor, ameryhung,
kernel-team
Make sure the verifier reject passing a hardcoded NULL to an
__arg_nonnull argument.
Signed-off-by: Amery Hung <ameryhung@gmail.com>
---
.../selftests/bpf/progs/verifier_global_subprogs.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
index 75a2e3f48d0f..67dc352addfd 100644
--- a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
+++ b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
@@ -185,6 +185,16 @@ int arg_tag_nonnull_ptr_good(void *ctx)
return subprog_nonnull_ptr_good(&x, &y);
}
+SEC("?raw_tp")
+__failure __log_level(2)
+__msg("R1 is expected to be non-NULL")
+int arg_tag_nonnull_ptr_null_bad(void *ctx)
+{
+ int y = 74;
+
+ return subprog_nonnull_ptr_good(NULL, &y);
+}
+
/* this global subprog can be now called from many types of entry progs, each
* with different context type
*/
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a global subprog
2026-07-23 22:18 [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a global subprog Amery Hung
2026-07-23 22:18 ` [PATCH bpf v2 2/2] selftests/bpf: Test passing scalar NULL to nonnull " Amery Hung
@ 2026-07-23 23:20 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-07-23 23:20 UTC (permalink / raw)
To: Amery Hung
Cc: bpf, alexei.starovoitov, andrii, daniel, eddyz87, memxor,
kernel-team
Hello:
This series was applied to bpf/bpf.git (master)
by Eduard Zingerman <eddyz87@gmail.com>:
On Thu, 23 Jul 2026 15:18:14 -0700 you wrote:
> A global subprogram argument tagged __arg_nonnull is set up as a
> non-nullable PTR_TO_MEM. However the verifier does not check against a
> scalar NULL, leading to real NULL pointer dereference. Reject it as
> well.
>
> Fixes: 94e1c70a3452 ("bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args")
> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
> Signed-off-by: Amery Hung <ameryhung@gmail.com>
>
> [...]
Here is the summary with links:
- [bpf,v2,1/2] bpf: Reject passing scalar NULL to nonnull arg of a global subprog
https://git.kernel.org/bpf/bpf/c/289e680c89ae
- [bpf,v2,2/2] selftests/bpf: Test passing scalar NULL to nonnull global subprog
https://git.kernel.org/bpf/bpf/c/55c7bd2ddee5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-23 23:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-23 22:18 [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a global subprog Amery Hung
2026-07-23 22:18 ` [PATCH bpf v2 2/2] selftests/bpf: Test passing scalar NULL to nonnull " Amery Hung
2026-07-23 23:20 ` [PATCH bpf v2 1/2] bpf: Reject passing scalar NULL to nonnull arg of a " patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox