[PATCH] bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

[PATCH] bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

[Avinash Pal]

A NULL pointer dereference occurs in map_kptr_match_type() when a BPF
program attempts to store a scalar value (non-pointer register) into a
map slot annotated as a kptr (kernel pointer).

Call chain:
  check_store_reg()
    -> check_mem_access()
       -> check_map_kptr_access()
          -> map_kptr_match_type()
             -> btf_is_kernel(reg->btf)   <-- NULL deref

For scalar registers reg->btf is NULL. map_kptr_match_type() passes
this directly to btf_is_kernel(), which performs a container_of()-based
offset access and triggers a general protection fault:

  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
  RIP: 0010:btf_is_kernel+0x2a/0x50

Fix: add an early NULL guard on reg->btf at the top of
map_kptr_match_type(). If reg->btf is NULL, emit a verifier log message
and return -EACCES so the program is rejected cleanly instead of
crashing the kernel.

Reproducer: store a scalar into a kptr-annotated BPF_MAP_TYPE_LRU_HASH
slot via a kprobe program — verifier crashes during bpf_prog_load().

Reported-by: Le Chen <le.chen@bugzilla.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221372
Signed-off-by: Avinash Pal <avinashpal441@gmail.com>
---
 kernel/bpf/verifier.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 69d75515ed..15b8f71074 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4545,6 +4545,18 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
 			       struct btf_field *kptr_field,
 			       struct bpf_reg_state *reg, u32 regno)
 {
+	/*
+	 * If the source register has no BTF type (e.g. it is a scalar),
+	 * it cannot possibly match a kptr slot. Reject early to avoid
+	 * passing a NULL reg->btf to btf_is_kernel(), which would cause
+	 * a NULL pointer dereference inside that function.
+	 */
+	if (!reg->btf) {
+		verbose(env, "R%d is not a pointer, cannot store into kptr slot\n",
+			regno);
+		return -EACCES;
+	}
+
 	const char *targ_name = btf_type_name(kptr_field->kptr.btf, kptr_field->kptr.btf_id);
 	int perm_flags;
 	const char *reg_name = "";
-- 
2.53.0

Re: [PATCH] bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

[sashiko-bot]

Sashiko AI review found 2 potential issue(s):
- [Medium] Invalid union access and type punning due to unverified `reg->btf` read.
- [Medium] Flawed bug diagnosis; patch addresses a structurally unreachable code path.
--

commit ce0e8cc557a90340c0553cc6fd6f929375190b78
Author: Avinash Pal <avinashpal441@gmail.com>

bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

This commit adds an early NULL check for the register BTF field in
map_kptr_match_type() to prevent an alleged NULL pointer dereference
when a scalar value is evaluated.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221372

> Call chain:
>   check_store_reg()
>     -> check_mem_access()
>        -> check_map_kptr_access()
>           -> map_kptr_match_type()
>              -> btf_is_kernel(reg->btf)   <-- NULL deref
>
> For scalar registers reg->btf is NULL. map_kptr_match_type() passes
> this directly to btf_is_kernel(), which performs a container_of()-based
> offset access and triggers a general protection fault:

Is this sequence actually possible in the unpatched code?

Looking at map_kptr_match_type(), the base register type is checked
before btf_is_kernel() is ever called:

    if (base_type(reg->type) != PTR_TO_BTF_ID)
        goto bad_type;

    if (btf_is_kernel(reg->btf)) {
        ...

For a scalar register, base_type(reg->type) evaluates to SCALAR_VALUE,
causing it to fail the PTR_TO_BTF_ID check and jump to the bad_type label
without evaluating btf_is_kernel(reg->btf).

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 69d75515ed3f7..15b8f71074f93 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4545,6 +4545,18 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
>  			       struct btf_field *kptr_field,
>  			       struct bpf_reg_state *reg, u32 regno)
>  {
> +	/*
> +	 * If the source register has no BTF type (e.g. it is a scalar),
> +	 * it cannot possibly match a kptr slot. Reject early to avoid
> +	 * passing a NULL reg->btf to btf_is_kernel(), which would cause
> +	 * a NULL pointer dereference inside that function.
> +	 */
> +	if (!reg->btf) {

Is it safe to access reg->btf before verifying the register type?

In struct bpf_reg_state, the btf pointer is part of an anonymous union
and shares memory with fields used by other register types, such as
range for PTR_TO_PACKET or mem_size for PTR_TO_MEM.

If a non-BTF register is evaluated and its aliased memory happens to be 0
(for example, a packet pointer with range == 0), could this incorrectly
trigger the early exit with -EACCES? This would bypass the expected type
mismatch handling and -EINVAL return code in the bad_type block.

> +		verbose(env, "R%d is not a pointer, cannot store into kptr slot\n",
> +			regno);
> +		return -EACCES;
> +	}
> +
>  	const char *targ_name = btf_type_name(kptr_field->kptr.btf, kptr_field->kptr.btf_id);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260419035948.9498-1-avinashpal441@gmail.com?part=1

[PATCH] bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

[Avinash Pal]

A NULL pointer dereference occurs in map_kptr_match_type() when a BPF
program attempts to store a scalar value (non-pointer register) into a
map slot annotated as a kptr (kernel pointer).

Call chain:
  check_store_reg()
    -> check_mem_access()
       -> check_map_kptr_access()
          -> map_kptr_match_type()
             -> btf_is_kernel(reg->btf)   <-- NULL deref

For scalar registers reg->btf is NULL. map_kptr_match_type() passes
this directly to btf_is_kernel(), which performs a container_of()-based
offset access and triggers a general protection fault:

  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
  RIP: 0010:btf_is_kernel+0x2a/0x50

Fix: add an early NULL guard on reg->btf at the top of
map_kptr_match_type(). If reg->btf is NULL, emit a verifier log message
and return -EACCES so the program is rejected cleanly instead of
crashing the kernel.

Reproducer: store a scalar into a kptr-annotated BPF_MAP_TYPE_LRU_HASH
slot via a kprobe program — verifier crashes during bpf_prog_load().

Reported-by: Le Chen <le.chen@bugzilla.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221372
Signed-off-by: Avinash Pal <avinashpal441@gmail.com>
---
 kernel/bpf/verifier.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 69d75515ed..15b8f71074 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4545,6 +4545,18 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
 			       struct btf_field *kptr_field,
 			       struct bpf_reg_state *reg, u32 regno)
 {
+	/*
+	 * If the source register has no BTF type (e.g. it is a scalar),
+	 * it cannot possibly match a kptr slot. Reject early to avoid
+	 * passing a NULL reg->btf to btf_is_kernel(), which would cause
+	 * a NULL pointer dereference inside that function.
+	 */
+	if (!reg->btf) {
+		verbose(env, "R%d is not a pointer, cannot store into kptr slot\n",
+			regno);
+		return -EACCES;
+	}
+
 	const char *targ_name = btf_type_name(kptr_field->kptr.btf, kptr_field->kptr.btf_id);
 	int perm_flags;
 	const char *reg_name = "";
-- 
2.53.0

Re: [PATCH] bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1254 bytes --]


commit 6c1cde9635b1379ee40c94c5ecc8a7d09507c0c9
Author: Avinash Pal <avinashpal441@gmail.com>

bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

A NULL pointer dereference occurs in map_kptr_match_type() when a BPF
program attempts to store a scalar value (non-pointer register) into a
map slot annotated as a kptr (kernel pointer).

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221372

This commit appears to fix a bug introduced in an earlier commit.
Should this include a Fixes: tag?

The fix guards against NULL reg->btf before calling btf_is_kernel(),
which suggests the vulnerability was introduced when map_kptr_match_type()
started using btf_is_kernel() without checking if reg->btf is NULL first.

Looking at the git history, commit 61df10c7799e ("bpf: Allow storing
unreferenced kptr in map") introduced map_kptr_match_type() and the call
to btf_is_kernel(reg->btf) without a NULL check.

Consider adding:

Fixes: 61df10c7799e ("bpf: Allow storing unreferenced kptr in map")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24620726038

Re: [PATCH] bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

[sun jian]

Hi Avinash,

This looks like the same bug Mykyta already addressed here:

https://lore.kernel.org/bpf/20260416-kptr_crash-v1-0-5589356584b4@meta.com/

That series includes both the verifier fix and a selftest for scalar
store into a kptr slot, and Alexei has already picked it up.

Thanks,

Re: [PATCH] bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

[sashiko-bot]

Sashiko AI review found 2 potential issue(s):
- [High] Type confusion and non-deterministic behavior by accessing union member `reg->btf` before validating register type.
- [Low] Compiler warning due to mixed declarations and executable code.
--

commit e1d023d433c4be96ed8eba9f6b8df2ec2929d841
Author: Avinash Pal <avinashpal441@gmail.com>

bpf: verifier: fix NULL deref in map_kptr_match_type() for scalar regs

This commit attempts to fix a NULL pointer dereference in
map_kptr_match_type() by adding an early return if reg->btf is NULL.
It targets a crash that occurs when storing a scalar value into a kptr slot.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221372

> For scalar registers reg->btf is NULL. map_kptr_match_type() passes
> this directly to btf_is_kernel(), which performs a container_of()-based
> offset access and triggers a general protection fault:

Since base_type(reg->type) != PTR_TO_BTF_ID evaluates to true for scalars,
wouldn't the code jump to bad_type before ever reaching btf_is_kernel()?

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 69d75515ed3f7..15b8f71074f93 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4545,6 +4545,18 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
>  			       struct btf_field *kptr_field,
>  			       struct bpf_reg_state *reg, u32 regno)
>  {
> +	/*
> +	 * If the source register has no BTF type (e.g. it is a scalar),
> +	 * it cannot possibly match a kptr slot. Reject early to avoid
> +	 * passing a NULL reg->btf to btf_is_kernel(), which would cause
> +	 * a NULL pointer dereference inside that function.
> +	 */
> +	if (!reg->btf) {
> +		verbose(env, "R%d is not a pointer, cannot store into kptr slot\n",
> +			regno);
> +		return -EACCES;
> +	}
> +

Does placing this executable code before the variable declarations trigger a
-Wdeclaration-after-statement compiler warning?

>  	const char *targ_name = btf_type_name(kptr_field->kptr.btf, kptr_field->kptr.btf_id);
>  	int perm_flags;
>  	const char *reg_name = "";

In struct bpf_reg_state, btf is part of a union:

struct bpf_reg_state {
    ...
    union {
        int range;
        ...
        struct {
            struct btf *btf;
            u32 btf_id;
        };
        ...
    };
    ...
};

By checking !reg->btf at the top of the function, does this read an inactive
union member before validating the register type?

For instance, if the register is a PTR_TO_PACKET with range == 0, could
reg->btf incorrectly evaluate to NULL here and return -EACCES instead of safely
falling through to the bad_type check below?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260419040426.9672-1-avinashpal441@gmail.com?part=1