Re: [PATCH RFC POC 2/4] binfmt_misc: add binfmt_misc_ops bpf struct_ops

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] TOCTOU race in bpf_binprm_set_interp allows bypassing the absolute path check.
--

--- Patch [2]: [PATCH RFC POC 2/4] binfmt_misc: add binfmt_misc_ops bpf struct_ops ---
commit dcb835dea31af56f46fb0ad454883c437389225a
Author: Christian Brauner <brauner@kernel.org>

binfmt_misc: add binfmt_misc_ops bpf struct_ops

This commit adds a BPF struct_ops backend for binfmt_misc. It allows
computing the interpreter programmatically for matching binaries instead of
relying on fixed strings.

Link: https://lore.kernel.org/20260704211409.1978485-1-farid.m.zakaria@gmail.com

> diff --git a/fs/binfmt_misc_bpf.c b/fs/binfmt_misc_bpf.c
> new file mode 100644
> index 0000000000000..72da0964d9491
> --- /dev/null
> +++ b/fs/binfmt_misc_bpf.c
[ ... ]
> +__bpf_kfunc int bpf_binprm_set_interp(struct linux_binprm *bprm,
> +				      const char *path, size_t path__sz)
> +{
> +	size_t len;
> +	char *interp;
> +
> +	if (!path__sz)
> +		return -EINVAL;
> +	len = strnlen(path, path__sz);
> +	if (len == path__sz)
> +		return -EINVAL;
> +	if (path[0] != '/')

[Severity: Medium]
Does this create a Time-of-Check to Time-of-Use (TOCTOU) race if path
points to a BPF map value?

If a BPF program passes a pointer to a map value as the path argument,
userspace could concurrently modify that map value after this check for '/'
but before the path is copied below. This would allow bypassing the
absolute path validation.

Should the string be copied via kmemdup_nul() first, and then the
absolute path check performed on the newly allocated interp buffer?

> +		return -EINVAL;
> +	if (len >= PATH_MAX)
> +		return -ENAMETOOLONG;
> +
> +	interp = kmemdup_nul(path, len, GFP_KERNEL);
> +	if (!interp)
> +		return -ENOMEM;
> +
> +	kfree(bprm->bpf_interp);
> +	bprm->bpf_interp = interp;
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707-work-bpf-binfmt_misc-v1-0-74b995c84ec1@kernel.org?part=2