Re: [PATCH bpf-next v2 1/9] bpf: Make KF_TRUSTED_ARGS the default for all kfuncs

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Wed Dec 31, 2025 at 12:08 PM EST, Puranjay Mohan wrote:
> Change the verifier to make trusted args the default requirement for
> all kfuncs by removing is_kfunc_trusted_args() assuming it be to always
> return true.
>
> This works because:
> 1. Context pointers (xdp_md, __sk_buff, etc.) are handled through their
>    own KF_ARG_PTR_TO_CTX case label and bypass the trusted check
> 2. Struct_ops callback arguments are already marked as PTR_TRUSTED during
>    initialization and pass is_trusted_reg()
> 3. KF_RCU kfuncs are handled separately via is_kfunc_rcu() checks at
>    call sites (always checked with || alongside is_kfunc_trusted_args)
>
> This simple change makes all kfuncs require trusted args by default
> while maintaining correct behavior for all existing special cases.
>
> Signed-off-by: Puranjay Mohan <puranjay@kernel.org>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

For sched-ext in particular, patchset works fine (as expected).

> ---
>  Documentation/bpf/kfuncs.rst | 35 +++++++++++++++++------------------
>  kernel/bpf/verifier.c        | 14 +++-----------
>  2 files changed, 20 insertions(+), 29 deletions(-)
>
> diff --git a/Documentation/bpf/kfuncs.rst b/Documentation/bpf/kfuncs.rst
> index e38941370b90..22b5a970078c 100644
> --- a/Documentation/bpf/kfuncs.rst
> +++ b/Documentation/bpf/kfuncs.rst
> @@ -241,25 +241,23 @@ both are orthogonal to each other.
>  The KF_RELEASE flag is used to indicate that the kfunc releases the pointer
>  passed in to it. There can be only one referenced pointer that can be passed
>  in. All copies of the pointer being released are invalidated as a result of
> -invoking kfunc with this flag. KF_RELEASE kfuncs automatically receive the
> -protection afforded by the KF_TRUSTED_ARGS flag described below.
> +invoking kfunc with this flag.
>  
> -2.4.4 KF_TRUSTED_ARGS flag
> ---------------------------
> +2.4.4 KF_TRUSTED_ARGS (default behavior)
> +-----------------------------------------
>  
> -The KF_TRUSTED_ARGS flag is used for kfuncs taking pointer arguments. It
> -indicates that the all pointer arguments are valid, and that all pointers to
> -BTF objects have been passed in their unmodified form (that is, at a zero
> -offset, and without having been obtained from walking another pointer, with one
> -exception described below).
> +All kfuncs now require trusted arguments by default. This means that all
> +pointer arguments must be valid, and all pointers to BTF objects must be
> +passed in their unmodified form (at a zero offset, and without having been
> +obtained from walking another pointer, with exceptions described below).
>  
> -There are two types of pointers to kernel objects which are considered "valid":
> +There are two types of pointers to kernel objects which are considered "trusted":
>  
>  1. Pointers which are passed as tracepoint or struct_ops callback arguments.
>  2. Pointers which were returned from a KF_ACQUIRE kfunc.
>  
>  Pointers to non-BTF objects (e.g. scalar pointers) may also be passed to
> -KF_TRUSTED_ARGS kfuncs, and may have a non-zero offset.
> +kfuncs, and may have a non-zero offset.
>  
>  The definition of "valid" pointers is subject to change at any time, and has
>  absolutely no ABI stability guarantees.
> @@ -327,13 +325,14 @@ added later.
>  2.4.7 KF_RCU flag
>  -----------------
>  
> -The KF_RCU flag is a weaker version of KF_TRUSTED_ARGS. The kfuncs marked with
> -KF_RCU expect either PTR_TRUSTED or MEM_RCU arguments. The verifier guarantees
> -that the objects are valid and there is no use-after-free. The pointers are not
> -NULL, but the object's refcount could have reached zero. The kfuncs need to
> -consider doing refcnt != 0 check, especially when returning a KF_ACQUIRE
> -pointer. Note as well that a KF_ACQUIRE kfunc that is KF_RCU should very likely
> -also be KF_RET_NULL.
> +The KF_RCU flag allows kfuncs to opt out of the default trusted args
> +requirement and accept RCU pointers with weaker guarantees. The kfuncs marked
> +with KF_RCU expect either PTR_TRUSTED or MEM_RCU arguments. The verifier
> +guarantees that the objects are valid and there is no use-after-free. The
> +pointers are not NULL, but the object's refcount could have reached zero. The
> +kfuncs need to consider doing refcnt != 0 check, especially when returning a
> +KF_ACQUIRE pointer. Note as well that a KF_ACQUIRE kfunc that is KF_RCU should
> +very likely also be KF_RET_NULL.
>  
>  2.4.8 KF_RCU_PROTECTED flag
>  ---------------------------
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 0baae7828af2..a31eace4a67c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -12040,11 +12040,6 @@ static bool is_kfunc_release(struct bpf_kfunc_call_arg_meta *meta)
>  	return meta->kfunc_flags & KF_RELEASE;
>  }
>  
> -static bool is_kfunc_trusted_args(struct bpf_kfunc_call_arg_meta *meta)
> -{
> -	return (meta->kfunc_flags & KF_TRUSTED_ARGS) || is_kfunc_release(meta);
> -}
> -
>  static bool is_kfunc_sleepable(struct bpf_kfunc_call_arg_meta *meta)
>  {
>  	return meta->kfunc_flags & KF_SLEEPABLE;
> @@ -13253,9 +13248,9 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>  			return -EINVAL;
>  		}
>  
> -		if ((is_kfunc_trusted_args(meta) || is_kfunc_rcu(meta)) &&
> -		    (register_is_null(reg) || type_may_be_null(reg->type)) &&
> -			!is_kfunc_arg_nullable(meta->btf, &args[i])) {
> +		if ((register_is_null(reg) || type_may_be_null(reg->type)) &&
> +		    !is_kfunc_arg_nullable(meta->btf, &args[i]) &&
> +		    !is_kfunc_arg_optional(meta->btf, &args[i])) {
>  			verbose(env, "Possibly NULL pointer passed to trusted arg%d\n", i);
>  			return -EACCES;
>  		}
> @@ -13320,9 +13315,6 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>  			fallthrough;
>  		case KF_ARG_PTR_TO_ALLOC_BTF_ID:
>  		case KF_ARG_PTR_TO_BTF_ID:
> -			if (!is_kfunc_trusted_args(meta) && !is_kfunc_rcu(meta))
> -				break;
> -
>  			if (!is_trusted_reg(reg)) {
>  				if (!is_kfunc_rcu(meta)) {
>  					verbose(env, "R%d must be referenced or trusted\n", regno);