Re: [PATCH bpf-next 3/5] selftests/bpf: add tests for bpf_memcmp

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The `__ign` suffix in `bpf_memcmp` and other string kfuncs bypasses BPF verifier checks, allowing arbitrary kernel memory reads and bypassing CAP_PERFMON capability restrictions.
--

commit 7bc905114c7536361d9f8dec63d9c798b78c1718
Author: Longjun Tang <tanglongjun@kylinos.cn>

selftests/bpf: add tests for bpf_memcmp
    
Add functional tests for equality, ordering, zero-size, and null-byte
handling. Add negative tests for NULL, user-space, and invalid kernel
pointer arguments.

> diff --git a/tools/testing/selftests/bpf/progs/string_kfuncs_failure1.c b/tools/testing/selftests/bpf/progs/string_kfuncs_failure1.c
> index bddc4e8579d24..a85d64605d0e7 100644
> --- a/tools/testing/selftests/bpf/progs/string_kfuncs_failure1.c
> +++ b/tools/testing/selftests/bpf/progs/string_kfuncs_failure1.c
> @@ -9,6 +9,9 @@
>  char *user_ptr = (char *)1;
>  char *invalid_kern_ptr = (char *)-1;
>  
> +extern int bpf_memcmp(const void *ptr1__ign, const void *ptr2__ign,
> +		      size_t size) __ksym;

[Severity: Critical]
This is a pre-existing issue, but does using the __ign suffix in the kfunc
declaration of bpf_memcmp allow BPF programs to bypass verifier capability
checks?

Looking at check_kfunc_args() in kernel/bpf/verifier.c, it appears the
verifier completely skips validation for arguments with the __ign suffix:

        if (is_kfunc_arg_ignore(btf, &args[i]) || is_kfunc_arg_implicit(meta, i))
                continue;

Since bpf_memcmp() is available in common_kfunc_set without requiring
CAP_PERFMON, could an attacker pass an arbitrary kernel address as a
SCALAR_VALUE to ptr1__ign or ptr2__ign?

Because bpf_memcmp() uses copy_from_kernel_nofault_allowed() and safely
handles the memory access without crashing, this could potentially provide an
oracle to leak kernel memory byte-by-byte, acting as an unrestricted bypass
for bpf_probe_read_kernel.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623030803.44798-1-lange_tang@163.com?part=3