Re: [PATCH bpf 1/2] bpf: Require referenced or trusted pointer for __arg_trusted arg

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: wrong multi-line comment style in check_func_arg()
--

commit 66de311fe0f463c286064b3e009d6635674afd83
Author: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>

bpf: Require referenced or trusted pointer for __arg_trusted arg

This commit modifies the verifier to reject PTR_TO_BTF_ID pointers that are
neither referenced nor trusted for arguments marked PTR_TRUSTED. It fixes an
issue where a bare PTR_TO_BTF_ID or MEM_RCU could bypass checks in subprogram
calls.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index fd3c0206bd67d..fe5edbef85a16 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -9597,6 +9597,27 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p
>  			}
>  		}
>  
> +		/* A __arg_trusted argument requires a referenced or trusted
> +		 * pointer. btf_ptr_types also matches a bare PTR_TO_BTF_ID and

[Severity: Low]
This isn't a bug, but does this violate the BPF subsystem multi-line comment
style? The BPF guideline requires the opening /* to be on its own line for
multi-line comments.

> +		 * an MEM_RCU one, but neither is referenced or trusted, so the
> +		 * callee would be verified with PTR_TRUSTED while the caller
> +		 * passed something that is not. PTR_MAYBE_NULL is not counted
> +		 * as unsafe when __arg_nullable declares it, because
> +		 * bpf_type_has_unsafe_modifiers() treats that flag as unsafe.
> +		 */
> +		if ((arg_type & PTR_TRUSTED) && base_type(reg->type) == PTR_TO_BTF_ID &&
> +		    !reg_is_referenced(env, reg)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261005-a3-arg-trusted-v4-v1-0-50ee0268fd39@mails.tsinghua.edu.cn?part=1