Re: [PATCH bpf-next v2 06/23] bpf: Unify kfunc argument kinds with enum bpf_arg_type

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing negative bounds check for enum parameter used as array index in kfuncs allows out-of-bounds kernel memory read.
--

commit 187c3e4699e70b4609c73e9f7618935e9265b164
Author: Amery Hung <ameryhung@gmail.com>
Date:   Fri Sep 11 22:03:58 2026 +0000

    bpf: Unify kfunc argument kinds with enum bpf_arg_type

    This commit folds the kfunc argument kinds into enum bpf_arg_type. It
    reuses ARG_SCALAR and maps kfunc callbacks to ARG_PTR_TO_FUNC, adding
    enumerators for kfunc-only kinds to allow check_kfunc_args() to carry one
    classification throughout verification.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 5d21bee458055..dc849e6708762 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -12178,15 +12145,15 @@ get_kfunc_arg_type(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,
>  	/* Scalar arguments are classified from their BTF suffix/name alone. */
>  	if (btf_type_is_scalar(t)) {
>  		if (is_kfunc_arg_constant(meta->btf, &args[arg]))
> -			return KF_ARG_CONST;
> +			return ARG_CONST_SCALAR;
>  		if (is_kfunc_arg_const_mem_size(meta->btf, &args[arg]))
> -			return KF_ARG_CONST_MEM_SIZE;
> +			return ARG_CONST_MEM_SIZE;
>  		if (is_kfunc_arg_mem_size(meta->btf, &args[arg]))
> -			return KF_ARG_MEM_SIZE;
> +			return ARG_MEM_SIZE;
>  		if (is_kfunc_arg_scalar_with_name(meta->btf, &args[arg], "rdonly_buf_size") ||
>  		    is_kfunc_arg_scalar_with_name(meta->btf, &args[arg], "rdwr_buf_size"))
> -			return KF_ARG_CONST_ALLOC_SIZE_OR_ZERO;
> -		return KF_ARG_ANYTHING;
> +			return ARG_CONST_ALLOC_SIZE_OR_ZERO;
> +		return ARG_SCALAR;
>  	}

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing how the
verifier classifies kfunc scalar/enum arguments, I noticed a pre-existing
issue where several memcg kfuncs take enums as array indices but lack
negative bounds checks.

Because the verifier treats enums as signed integers and does not enforce
valid enum ranges, a BPF program can pass negative values to these kfuncs
to bypass the upper-bound checks and read out-of-bounds kernel memory.

For example, in mm/bpf_memcontrol.c:bpf_mem_cgroup_memory_events():

__bpf_kfunc unsigned long bpf_mem_cgroup_memory_events(struct mem_cgroup *memcg,
						       enum memcg_memory_event event)
{
	if (unlikely(event >= MEMCG_NR_MEMORY_EVENTS))
		return (unsigned long)-1;

	return atomic_long_read(&memcg->memory_events[event]);
}

A negative event value bypasses the signed upper bounds check and directly
indexes memory_events[-1].

A similar missing negative bounds check exists in
mm/bpf_memcontrol.c:bpf_mem_cgroup_vm_events():

__bpf_kfunc unsigned long bpf_mem_cgroup_vm_events(struct mem_cgroup *memcg,
						   enum vm_event_item event)
{
	if (unlikely(!memcg_vm_event_item_valid(event)))
		return (unsigned long)-1;

The negative integer is forwarded to mm/memcontrol.c:memcg_vm_event_item_valid()
which also lacks a lower bound check:

bool memcg_vm_event_item_valid(enum vm_event_item idx)
{
	if (idx >= NR_VM_EVENT_ITEMS)
		return false;

	return !BAD_STAT_IDX(memcg_events_index(idx));
}

Could this allow users capable of loading BPF programs to bypass KASLR or
leak adjacent kernel heap memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911220415.1396439-1-ameryhung@gmail.com?part=6