[PATCH bpf v2 0/2] bpf: Fix refcount_acquire handling for borrowed kptrs

[Ning Ding <dingning04@gmail.com>]

This series fixes two bugs in bpf_refcount_acquire() verifier handling.

Patch 1 fixes return-value tracking. The verifier can treat an
RCU-loaded borrowed map kptr as owning and mark the return value
non-NULL. At runtime, bpf_refcount_acquire() can still return NULL,
allowing an unchecked NULL value to reach bpf_obj_drop() and crash the
kernel.

Patch 2 fixes argument validation. After bpf_rcu_read_unlock(), the
pointer is PTR_UNTRUSTED, but the verifier still allows it to be passed
to bpf_refcount_acquire(). A reproducer with only CAP_BPF acquired a
reference through this stale pointer after the original object was
dropped and its address was reused.

The series adds verifier regression tests for both cases.

Changes since v1:
- Patch 1 is unchanged.
- Added Patch 2 to reject PTR_UNTRUSTED refcounted kptr inputs after
  bpf_rcu_read_unlock().
- Reused the refcount-only selftest fixture introduced by Patch 1.
- Added fail-before/pass-after verifier validation and CAP_BPF-only
  runtime confirmation.

Link: https://lore.kernel.org/r/20260726015330.705259-1-dingning04@gmail.com

Ning Ding (2):
  bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
  bpf: Reject untrusted pointers in refcount_acquire

 kernel/bpf/verifier.c                         |  7 +-
 .../selftests/bpf/progs/refcounted_kptr.c     | 61 +++++++++++++++
 .../bpf/progs/refcounted_kptr_fail.c          | 74 +++++++++++++++++++
 3 files changed, 141 insertions(+), 1 deletion(-)

-- 
2.43.0