Re: [PATCH bpf-next v3 1/9] bpf: Support __arena and __arena_nullable kfunc argument suffixes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Valid allocated arena objects at page offset 0 are incorrectly translated to NULL when passed to __arena_nullable kfunc arguments.
--

--- Patch [1]: [PATCH bpf-next v3 1/9] bpf: Support __arena and __arena_nullable kfunc argument suffixes ---
commit d1b161404c5304b1bf05e11ad5b7dc889d1dcee6
Author: Tejun Heo <tj@kernel.org>

bpf: Support __arena and __arena_nullable kfunc argument suffixes

This commit adds support for __arena and __arena_nullable kfunc argument
suffixes, allowing kfuncs to receive directly dereferenceable kernel addresses
for arena pointers. It updates the verifier to distill these into argument
flags for the JIT to retrieve.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b274004fccfd9..4c50237f49f13 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -12154,6 +12167,31 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
>  
>  		t = btf_type_skip_modifiers(btf, args[i].type, NULL);
>  
> +		if (base_type(kf_arg_type) == KF_ARG_PTR_TO_ARENA) {

[Severity: High]
Can a valid allocated arena object at page offset 0 be incorrectly translated
to NULL when passed to an __arena_nullable kfunc argument?

Looking at arena_map_alloc() in kernel/bpf/arena.c, the range tree of free
pages includes page offset 0:

    err = range_tree_set(&arena->rt, 0, attr->max_entries);

If a user process mmaps the arena or sets map_extra at an address where the
lower 32 bits are zero (e.g., 0x7f0000000000), a BPF program could allocate
an object that gets offset 0. When passed to an __arena_nullable kfunc
argument, the JIT would see the lower 32 bits as exactly zero.

Since the commit message states that __arena_nullable skips the rebase when
the truncated value (arena offset 0) is zero to preserve NULL, would this
cause the kfunc to incorrectly assume a valid optional argument is absent
and lead to dropped data or logic errors?

> +			if (!bpf_jit_supports_arena_args()) {
> +				verbose(env, "JIT does not support kfunc %s() with arena pointer arguments\n",
> +					func_name);
> +				return -ENOTSUPP;
> +			}
> +			if (!env->prog->aux->arena) {
> +				verbose(env,
> +					"%s arena pointer requires a program with an associated arena\n",
> +					reg_arg_name(env, argno));
> +				return -EINVAL;
> +			}
> +			if (regno < 0) {
> +				verbose(env, "%s arena pointer cannot be a stack argument\n",
> +					reg_arg_name(env, argno));
> +				return -EINVAL;
> +			}
> +			if (reg->type != PTR_TO_ARENA && reg->type != SCALAR_VALUE) {
> +				verbose(env, "%s is not a pointer to arena or scalar\n",
> +					reg_arg_name(env, argno));
> +				return -EINVAL;
> +			}
> +			continue;
> +		}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803125115.2264733-1-memxor@gmail.com?part=1