[PATCH bpf v3 0/4] bpf: Fix refcount_acquire handling for borrowed kptrs

[Ning Ding <dingning04@gmail.com>]

Fix two verifier bugs involving bpf_refcount_acquire() and map kptrs.

First, the verifier can mistake an RCU-loaded map kptr for an owned
reference and assume bpf_refcount_acquire() cannot return NULL. The kfunc
can return NULL after the last reference is dropped, so passing an
unchecked result to bpf_obj_drop() can crash the kernel.

Second, type_is_ptr_alloc_obj() accepts PTR_UNTRUSTED pointers. This lets a
pointer that is no longer protected by RCU reach bpf_refcount_acquire(). If
the object was freed and its address reused, the verifier may acquire a
reference through stale memory.

Patches 1 and 2 fix and test the return-value nullability. Patches 3 and 4
reject untrusted allocated-object pointers while keeping safe
BPF_PROBE_MEM reads accepted.

The series is based on bpf commit e5fd3f514e27
("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()").

Testing used fresh virtme-ng KVM boots with KASAN enabled:

  pre-fix graph write:       accepted, as expected
  post-fix focused cases:    8/8 passed
  full refcount groups:      47/47 passed
  related list/rbtree groups: 167/167 passed
  skipped or failed cases:   none
  KASAN/Oops/panic markers:  none

---
v3:
  - Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED, as suggested by
    Kumar Kartikeya Dwivedi.
  - Add a separate helper for the BPF_PROBE_MEM read path.
  - Add read, refcount-acquire, and direct-write verifier tests.
  - Add Cc: stable@vger.kernel.org to both fixes, as requested by Greg
    Kroah-Hartman.
  - Split each fix from its selftests.

v2: https://lore.kernel.org/r/20260726235030.1152542-1-dingning04@gmail.com
v1: https://lore.kernel.org/r/20260726015330.705259-1-dingning04@gmail.com

Ning Ding (4):
  bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
  selftests/bpf: Test refcount_acquire return nullability
  bpf: Reject untrusted allocated-object pointers
  selftests/bpf: Test untrusted allocated-object pointers

 include/linux/bpf_verifier.h                  |  11 +-
 kernel/bpf/verifier.c                         |  10 +-
 .../selftests/bpf/progs/refcounted_kptr.c     | 161 ++++++++++++++++++
 .../bpf/progs/refcounted_kptr_fail.c          |  74 ++++++++
 4 files changed, 253 insertions(+), 3 deletions(-)


base-commit: e5fd3f514e27db1f05fbd72ba615d74941e23c51
-- 
2.43.0