Re: [RFC PATCH bpf-next v1 07/16] bpf: Trust typed pointer fields of typed arena objects

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: refcount leak in bpf_typed_arena causes saturation and WARN
--

commit 824870737e5e6082cced029879731300754bd906
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Subject: bpf: Trust typed pointer fields of typed arena objects

This commit introduces logic to track and trust typed pointer fields
within typed arena objects. A load from these fields returns an
unsanitized pointer which is considered trustworthy without additional
checks, and writes ensure only valid typed arena pointers or null are
stored.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -6328,6 +6348,61 @@ static bool type_is_trusted_or_null(struct bpf_verifier_env *env,
[ ... ]
> +static int check_typed_ptr_field_access(struct bpf_verifier_env *env, struct bpf_reg_state *regs,
> +					struct bpf_reg_state *reg, const char *tname, u32 btf_id,
> +					enum bpf_access_type atype, int value_regno)
> +{
> +	struct bpf_insn *insn = &env->prog->insnsi[env->insn_idx];
> +	u8 class = BPF_CLASS(insn->code);
> +	struct bpf_reg_state *val;
> +	struct bpf_typed_arena *ta;
> +
> +	if (BPF_MODE(insn->code) != BPF_MEM || BPF_SIZE(insn->code) != BPF_DW ||
> +	    (class != BPF_LDX && class != BPF_STX && class != BPF_ST)) {
> +		verbose(env, "typed pointer field of struct %s must be accessed with a 64-bit load or store\n",
> +			tname);
> +		return -EACCES;
> +	}
> +	if (atype == BPF_READ) {
> +		/*
> +		 * The pointer leads into the pointee's typed arena, which the
> +		 * program may never cast to or allocate from: register it here,
> +		 * as a cast would, so that the sanitization has a slice to mask
> +		 * into and the slice exists for the map's lifetime.
> +		 */
> +		ta = typed_arena_register(env, btf_id);

[Severity: Medium]
Could this lead to a refcount leak for the typed arena when the program
is unloaded?

When typed_arena_register() is called here, it acquires a reference to
the typed arena via bpf_typed_arena_get() which increments ta->refcnt.
However, the program unload path in bpf_prog_free_deferred() skips
releasing the reference acquired during load:

kernel/bpf/core.c:bpf_prog_free_deferred() {
    ...
    /* The typed arenas outlive the program; only the load's failure retracts them. */
    kfree(aux->typed_arenas);
    ...
}

Because the reference is never decremented after a successful load, the
refcount will monotonically increase by one per load and unload cycle.

Since this path is reachable by any user capable of loading BPF programs,
is it possible for a user to repeatedly load and unload a program to
saturate the refcount and trigger a kernel WARN?

> +		if (IS_ERR(ta))
> +			return PTR_ERR(ta);
> +		return mark_btf_ld_reg(env, regs, value_regno, PTR_TO_BTF_ID, reg->btf, btf_id,
> +				       MEM_ARENA | PTR_UNSANITIZED);
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926233503.3114147-1-memxor@gmail.com?part=7