Re: [PATCH bpf-next v3 12/18] bpf: Classify kfunc mem_size args from BTF without register state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Removing the register type check from `is_kfunc_arg_mem_size()` allows a BPF program to pass a pointer register as a memory size parameter (`__sz`), which triggers a `verifier_bug` and a kernel warning.
--

--- Patch [12]: [PATCH bpf-next v3 12/18] bpf: Classify kfunc mem_size args from BTF without register state ---
commit e7666ea9e561228e1708d772f8e42d33c514cde8
Author: Amery Hung <ameryhung@gmail.com>

bpf: Classify kfunc mem_size args from BTF without register state

This commit removes register state checks from is_kfunc_arg_mem_size() and
is_kfunc_arg_const_mem_size(). It relies solely on BTF to classify kfunc
memory size arguments to further decouple argument type classification from
register state.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 6fc22a4e38b26..d65da54f9c0f8 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -10785,26 +10785,24 @@ static bool is_kfunc_rcu_protected(struct bpf_call_arg_meta *meta)
>  }
>  
>  static bool is_kfunc_arg_mem_size(const struct btf *btf,
> -				  const struct btf_param *arg,
> -				  const struct bpf_reg_state *reg)
> +				  const struct btf_param *arg)
>  {
>  	const struct btf_type *t;
>  
>  	t = btf_type_skip_modifiers(btf, arg->type, NULL);
> -	if (!btf_type_is_scalar(t) || reg->type != SCALAR_VALUE)
> +	if (!btf_type_is_scalar(t))

[Severity: High]
Does removing this SCALAR_VALUE check allow a BPF program to pass a pointer
register instead of a scalar to a kfunc's size argument, potentially
triggering a verifier_bug()?

If get_kfunc_ptr_arg_type() sets arg_mem_size purely based on BTF,
check_kfunc_args() will process the memory pointer argument, peek ahead at
the size argument, and call check_mem_size_reg():

kernel/bpf/verifier.c:check_kfunc_args() {
    ...
    ret = check_mem_size_reg(env, buff_reg, size_reg, argno, next_argno,
                             BPF_READ | BPF_WRITE, true, meta);
    ...
}

This happens before the main loop reaches the size argument and ensures it is
a SCALAR_VALUE.

If a pointer register with a fixed zero offset is passed,
check_mem_size_reg() might assume it is a valid scalar value of 0, pass the
boundary checks, and call mark_chain_precision(). This explicitly triggers
verifier_bug(env, "backtracking misuse") if the register is not a
SCALAR_VALUE.

Could this lead to a kernel panic on systems with panic_on_warn=1?

>  		return false;
>  
>  	return btf_param_match_suffix(btf, arg, "__sz");
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260801074633.1595644-1-ameryhung@gmail.com?part=12