Re: [PATCH bpf 01/10] bpf: mark a NULL call argument precise

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] This problem wasn't introduced by this patch, but the patch and the series fail to fix it while fixing identical vulnerabilities elsewhere. Missing precision tracking for nullable arguments was fixed in `check_func_arg()`, `check_helper_call()`, `check_kfunc_args()`, and `btf_check_func_arg_match()`. However, the exact same vulnerability remains in `check_map_kptr_access()`. When storing a NULL value into a kptr map field via `BPF_STX`, `check_map_kptr_access()` checks `bpf_register_is_null(val_reg)` to bypass pointer type validation. Because it skips validation on a NULL scalar without calling `mark_chain_precision()`, a checkpoint created with a NULL scalar in `val_reg` will incorrectly prune a subsequent path where `val_reg` holds an arbitrary, unconstrained scalar value. At runtime, this pruned path will execute and write an invalid scalar into the kptr field. When the map is later freed, the kernel will attempt to drop the kptr by treating the invalid scalar as a valid pointer, resulting in arbitrary kernel memory corruption.
--

commit a287fdd95b87b267c8cbd45bc11d4088d9532eb9
Author: Eduard Zingerman <eddyz87@gmail.com>

bpf: mark a NULL call argument precise

This commit fixes verifier pruning logic by marking NULL call arguments precise
in check_func_arg() and check_helper_call(). This prevents the verifier from
incorrectly pruning paths with unconstrained scalars against checkpoints with
NULL scalars.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9c6ad157a61ec..ca362a7ea58c3 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -8752,11 +8752,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>  			return err;
>  	}
>  
> -	if (bpf_register_is_null(reg) && type_may_be_null(arg_type))
> +	if (bpf_register_is_null(reg) && type_may_be_null(arg_type)) {
>  		/* A NULL register has a SCALAR_VALUE type, so skip
>  		 * type checking.
>  		 */
> +		err = mark_chain_precision(env, regno);
> +		if (err)
> +			return err;
>  		goto skip_type_check;
> +	}

[Severity: Critical]
This isn't a bug introduced by this patch, but the series appears to miss
an identical vulnerability in check_map_kptr_access().

When storing a NULL value into a kptr map field via BPF_STX,
check_map_kptr_access() checks bpf_register_is_null(val_reg) to bypass
pointer type validation:

kernel/bpf/verifier.c:check_map_kptr_access()
    } else if (class == BPF_STX) {
        val_reg = reg_state(env, value_regno);
        if (!bpf_register_is_null(val_reg) &&
            map_kptr_match_type(env, kptr_field, val_reg, value_regno))
            return -EACCES;
    }

Because it skips validation on a NULL scalar without calling
mark_chain_precision(), a checkpoint created with a NULL scalar in val_reg
could incorrectly prune a subsequent path where val_reg holds an arbitrary,
unconstrained scalar value.

At runtime, this pruned path could execute and write an invalid scalar into
the kptr field. When the map is later freed, the kernel would attempt to drop
the kptr by treating the invalid scalar as a valid pointer.

Could this lead to arbitrary kernel memory corruption? Should
mark_chain_precision() be called on value_regno when
bpf_register_is_null(val_reg) is true here as well?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904-register-is-null-precise-fixes-v1-0-0f5a360ff15d@gmail.com?part=1