From: sashiko-bot@kernel.org
To: "Eduard Zingerman" <eddyz87@gmail.com>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf 07/10] bpf: mark a NULL BTF_ID argument of a global subprogram precise
Date: Sat, 05 Sep 2026 00:19:55 +0000 [thread overview]
Message-ID: <20260905001956.1FFA21F00A3D@smtp.kernel.org> (raw)
In-Reply-To: <20260904-register-is-null-precise-fixes-v1-7-0f5a360ff15d@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [Critical] Missing precision marking for NULL register in `check_map_kptr_access` bypasses kptr type checks, enabling arbitrary kernel memory read/write.
--
commit 86bb17dfcff95ef6eeda4b1333ab93abe99ab7bb
Author: Eduard Zingerman <eddyz87@gmail.com>
bpf: mark a NULL BTF_ID argument of a global subprogram precise
btf_check_func_arg_match() accepts a NULL register for an
ARG_PTR_TO_BTF_ID argument tagged __arg_nullable and skips
check_reg_type() and check_func_arg_reg_off() without marking the
register precise. Hence a checkpoint created on such a path would
prune against arbitrary scalar value.
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 2b3d080978062..3c3575215899b 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -9767,8 +9767,12 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
> struct bpf_call_arg_meta meta;
> int err;
>
> - if (bpf_register_is_null(reg) && type_may_be_null(arg->arg_type))
> + if (bpf_register_is_null(reg) && type_may_be_null(arg->arg_type)) {
> + err = mark_arg_precision(env, argno);
> + if (err)
> + return err;
> continue;
> + }
>
> memset(&meta, 0, sizeof(meta)); /* leave func_id as zero */
[Severity: Critical]
This isn't a bug introduced by this patch, but does the same missing
precision issue exist in check_map_kptr_access() for BPF_STX operations?
Looking at check_map_kptr_access() when handling BPF_STX:
} else if (class == BPF_STX) {
val_reg = reg_state(env, value_regno);
if (!bpf_register_is_null(val_reg) &&
map_kptr_match_type(env, kptr_field, val_reg, value_regno))
return -EACCES;
}
If a BPF program branch sets the register to 0, bpf_register_is_null()
returns true, and the type check is skipped without calling
mark_chain_precision().
Could a subsequent branch set the same register to an arbitrary non-zero
scalar and get incorrectly pruned by regsafe() because it compares against
the imprecise 0?
This sequence appears to allow storing an arbitrary scalar as a forged
pointer into a map. This could then lead to arbitrary memory read/write or
local privilege escalation when the kernel later drops or uses the kptr.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260904-register-is-null-precise-fixes-v1-0-0f5a360ff15d@gmail.com?part=7
next prev parent reply other threads:[~2026-09-05 0:19 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-05 0:05 [PATCH bpf 00/10] bpf: add missing precision propagation after bpf_register_is_null calls Eduard Zingerman
2026-09-05 0:05 ` [PATCH bpf 01/10] bpf: mark a NULL call argument precise Eduard Zingerman
2026-09-05 0:21 ` sashiko-bot
2026-09-05 0:05 ` [PATCH bpf 02/10] selftests/bpf: precision of a NULL helper argument Eduard Zingerman
2026-09-05 0:05 ` [PATCH bpf 03/10] bpf: mark a NULL memory argument of a call precise Eduard Zingerman
2026-09-05 0:23 ` sashiko-bot
2026-09-05 0:51 ` bot+bpf-ci
2026-09-05 0:05 ` [PATCH bpf 04/10] selftests/bpf: precision of a NULL global subprogram memory argument Eduard Zingerman
2026-09-05 0:51 ` bot+bpf-ci
2026-09-05 0:05 ` [PATCH bpf 05/10] bpf: mark a NULL kfunc argument precise Eduard Zingerman
2026-09-05 0:51 ` bot+bpf-ci
2026-09-05 0:05 ` [PATCH bpf 06/10] selftests/bpf: precision of a NULL kfunc argument Eduard Zingerman
2026-09-05 0:05 ` [PATCH bpf 07/10] bpf: mark a NULL BTF_ID argument of a global subprogram precise Eduard Zingerman
2026-09-05 0:19 ` sashiko-bot [this message]
2026-09-05 0:05 ` [PATCH bpf 08/10] selftests/bpf: precision of a NULL global subprogram BTF_ID argument Eduard Zingerman
2026-09-05 0:06 ` [PATCH bpf 09/10] bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() Eduard Zingerman
2026-09-05 0:06 ` [PATCH bpf 10/10] bpf: use mark_arg_precision() in check_mem_size_reg() Eduard Zingerman
2026-09-05 0:51 ` bot+bpf-ci
2026-09-05 1:20 ` [PATCH bpf 00/10] bpf: add missing precision propagation after bpf_register_is_null calls patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260905001956.1FFA21F00A3D@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=eddyz87@gmail.com \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox