[PATCH bpf] bpf: Keep refcount_acquire nullable for borrowed RCU kptrs

[PATCH bpf] bpf: Keep refcount_acquire nullable for borrowed RCU kptrs

[Ning Ding]

bpf_refcount_acquire() can fail for a refcounted map kptr loaded
within RCU. Another execution can replace the map kptr and drop the
last owning reference after the pointer is loaded but before the
acquire, causing refcount_inc_not_zero() to fail.

check_kfunc_args() currently treats a refcounted pointer as owning
whenever it is not explicitly marked NON_OWN_REF. But an RCU-loaded
map kptr can lack NON_OWN_REF while still being borrowed and absent
from the verifier state's acquired-reference tracking. This sets
arg_owning_ref and causes is_kfunc_ret_null() to suppress KF_RET_NULL,
allowing an unchecked NULL return from bpf_refcount_acquire() to be
passed to bpf_obj_drop().

Require reg_is_referenced() before treating the input as owning. Add
tests for a genuine owning input, a checked borrowed RCU input, and
an unchecked borrowed RCU input.

Fixes: 7793fc3babe9 ("bpf: Make bpf_refcount_acquire fallible for non-owning refs")
Assisted-by: Codex:gpt-5.5
Assisted-by: ChatGPT:GPT-5.6-Thinking
Signed-off-by: Ning Ding <dingning04@gmail.com>
---
 kernel/bpf/verifier.c                         |  2 +-
 .../selftests/bpf/progs/refcounted_kptr.c     | 61 +++++++++++++++++++
 .../bpf/progs/refcounted_kptr_fail.c          | 47 ++++++++++++++
 3 files changed, 109 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7aa47342dc65..1e7343b625de 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -12419,7 +12419,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
 					reg_arg_name(env, argno));
 				return -EINVAL;
 			}
-			if (!type_is_non_owning_ref(reg->type))
+			if (!type_is_non_owning_ref(reg->type) && reg_is_referenced(env, reg))
 				meta->arg_owning_ref = true;
 
 			rec = reg_btf_record(reg);
diff --git a/tools/testing/selftests/bpf/progs/refcounted_kptr.c b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
index 61906f48025c..fd35093285c0 100644
--- a/tools/testing/selftests/bpf/progs/refcounted_kptr.c
+++ b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
@@ -23,6 +23,15 @@ struct map_value {
 	struct node_data __kptr *node;
 };
 
+struct node_refcount_only {
+	long key;
+	struct bpf_refcount refcount;
+};
+
+struct map_value_refcount_only {
+	struct node_refcount_only __kptr *node;
+};
+
 struct {
 	__uint(type, BPF_MAP_TYPE_ARRAY);
 	__type(key, int);
@@ -30,6 +39,13 @@ struct {
 	__uint(max_entries, 2);
 } stashed_nodes SEC(".maps");
 
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__type(key, int);
+	__type(value, struct map_value_refcount_only);
+	__uint(max_entries, 1);
+} stashed_refcount_only SEC(".maps");
+
 struct node_acquire {
 	long key;
 	long data;
@@ -832,6 +848,51 @@ long rbtree_refcounted_node_ref_escapes_owning_input(void *ctx)
 	return 0;
 }
 
+SEC("tc")
+__success
+long refcount_acquire_owning_input_no_null_check(void *ctx)
+{
+	struct node_refcount_only *n, *m;
+
+	n = bpf_obj_new(typeof(*n));
+	if (!n)
+		return 1;
+
+	m = bpf_refcount_acquire(n);
+	bpf_obj_drop(m);
+	bpf_obj_drop(n);
+
+	return 0;
+}
+
+SEC("tc")
+__success
+long refcount_acquire_rcu_map_kptr_null_checked(void *ctx)
+{
+	struct map_value_refcount_only *mapval;
+	struct node_refcount_only *n, *m;
+	int idx = 0;
+
+	mapval = bpf_map_lookup_elem(&stashed_refcount_only, &idx);
+	if (!mapval)
+		return 1;
+
+	bpf_rcu_read_lock();
+	n = mapval->node;
+	if (!n) {
+		bpf_rcu_read_unlock();
+		return 2;
+	}
+	m = bpf_refcount_acquire(n);
+	bpf_rcu_read_unlock();
+
+	if (!m)
+		return 3;
+	bpf_obj_drop(m);
+
+	return 0;
+}
+
 static long __stash_map_empty_xchg(struct node_data *n, int idx)
 {
 	struct map_value *mapval = bpf_map_lookup_elem(&stashed_nodes, &idx);
diff --git a/tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c b/tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c
index 024ef2aae200..acd3e81a3916 100644
--- a/tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c
+++ b/tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c
@@ -19,6 +19,15 @@ struct node_refcounted {
 	struct bpf_refcount refcount;
 };
 
+struct node_refcount_only {
+	long key;
+	struct bpf_refcount refcount;
+};
+
+struct map_value_refcount_only {
+	struct node_refcount_only __kptr *node;
+};
+
 extern void bpf_rcu_read_lock(void) __ksym;
 extern void bpf_rcu_read_unlock(void) __ksym;
 
@@ -28,6 +37,13 @@ private(A) struct bpf_rb_root groot __contains(node_acquire, node);
 private(B) struct bpf_spin_lock lock;
 private(B) struct bpf_list_head head __contains(node_refcounted, list);
 
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__type(key, int);
+	__type(value, struct map_value_refcount_only);
+	__uint(max_entries, 1);
+} stashed_refcount_only SEC(".maps");
+
 static bool less(struct bpf_rb_node *a, const struct bpf_rb_node *b)
 {
 	struct node_acquire *node_a;
@@ -80,6 +96,37 @@ long refcount_acquire_maybe_null(void *ctx)
 	return 0;
 }
 
+SEC("?tc")
+__failure __msg("Possibly NULL pointer passed to trusted R1")
+long refcount_acquire_rcu_map_kptr_unchecked_drop(void *ctx)
+{
+	struct map_value_refcount_only *mapval;
+	struct node_refcount_only *tmp, *n, *m;
+	int idx = 0;
+
+	tmp = bpf_obj_new(typeof(*tmp));
+	if (!tmp)
+		return 3;
+	bpf_obj_drop(tmp);
+
+	mapval = bpf_map_lookup_elem(&stashed_refcount_only, &idx);
+	if (!mapval)
+		return 1;
+
+	bpf_rcu_read_lock();
+	n = mapval->node;
+	if (!n) {
+		bpf_rcu_read_unlock();
+		return 2;
+	}
+	m = bpf_refcount_acquire(n);
+	bpf_rcu_read_unlock();
+
+	bpf_obj_drop(m);
+
+	return 0;
+}
+
 SEC("?tc")
 __failure __msg("Unreleased reference id=3 alloc_insn={{[0-9]+}}")
 long rbtree_refcounted_node_ref_escapes_owning_input(void *ctx)

base-commit: 0ce37745d4bfbc493f718169c3974898ffec8ee7
-- 
2.43.0

Re: [PATCH bpf] bpf: Keep refcount_acquire nullable for borrowed RCU kptrs

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] bpf_refcount_acquire() permits untrusted pointers due to inadequate modifier checks, leading to Use-After-Free.
--

--- Patch [1]: [PATCH bpf] bpf: Keep refcount_acquire nullable for borrowed RCU kptrs ---
commit 5798e6cddf6ec01af2fa26e9f86dfc1bb3fd1681
Author: Ning Ding <dingning04@gmail.com>

bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
    
bpf_refcount_acquire() can fail for a refcounted map kptr loaded
within RCU. Another execution can replace the map kptr and drop the
last owning reference after the pointer is loaded but before the
acquire, causing refcount_inc_not_zero() to fail.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 7aa47342dc659..1e7343b625de5 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -12419,7 +12419,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>  					reg_arg_name(env, argno));
>  				return -EINVAL;
>  			}

[Severity: Critical]
This is a pre-existing issue, but does bpf_refcount_acquire() permit untrusted
pointers due to inadequate modifier checks, potentially leading to a
use-after-free?

In check_kfunc_args(), KF_ARG_PTR_TO_REFCOUNTED_KPTR skips the is_trusted_reg()
checks that are applied to other pointer types. The argument is subsequently
validated using type_is_ptr_alloc_obj():

include/linux/bpf_verifier.h:type_is_ptr_alloc_obj() {
    return base_type(type) == PTR_TO_BTF_ID && type_flag(type) & MEM_ALLOC;
}

Since type_is_ptr_alloc_obj() only requires MEM_ALLOC to be set and does not
restrict unsafe modifiers, it returns true for a pointer with the PTR_UNTRUSTED
flag.

If a BPF program loads a refcounted pointer from a map inside an RCU read-side
critical section, checks it for NULL, and then drops the RCU lock using
bpf_rcu_read_unlock(), the pointer's verifier type is updated to include the
PTR_UNTRUSTED flag.

The program can then pass this untrusted pointer to bpf_refcount_acquire(),
which bypasses trusted register checks and accepts it. At runtime, the
bpf_refcount_acquire_impl kfunc executes refcount_inc_not_zero() on the
provided untrusted address.

Since the address might have already been freed outside the RCU critical
section, could this result in memory corruption or a kernel panic? While this
patch sets meta->arg_owning_ref = false for untrusted inputs, does it fail to
prevent the unsafe input pointer from being dereferenced inside the kfunc
itself?

> -			if (!type_is_non_owning_ref(reg->type))
> +			if (!type_is_non_owning_ref(reg->type) && reg_is_referenced(env, reg))
>  				meta->arg_owning_ref = true;
>  
>  			rec = reg_btf_record(reg);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260726015330.705259-1-dingning04@gmail.com?part=1

[PATCH bpf] bpf: Reject writes through untrusted allocated pointers

[Ning Ding]

A kptr loaded under an RCU read lock has MEM_ALLOC set. After
bpf_rcu_read_unlock(), the verifier marks it PTR_UNTRUSTED, but
check_ptr_to_btf_access() still allows writes because
type_is_ptr_alloc_obj() ignores that flag.

Reject writes through MEM_ALLOC pointers that are PTR_UNTRUSTED. Reads
remain allowed and are converted to probe-memory accesses.

Also skip the owning-reference check for these pointers, since they no
longer have a live reference after leaving the RCU critical section.

Add verifier tests for the rejected write and permitted read cases.

Fixes: 503e4def5414 ("bpf: Replace open code with for allocated object check")
Closes: https://lore.kernel.org/all/20260726021304.97ED91F000E9@smtp.kernel.org/
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Ning Ding <dingning04@gmail.com>
---
 kernel/bpf/verifier.c                         |  6 +-
 .../bpf/progs/local_kptr_stash_fail.c         | 58 +++++++++++++++++++
 2 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7aa47342dc65..24c151ad2e62 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5804,13 +5804,15 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 		 * program allocated objects (which always have id > 0),
 		 * but not for untrusted PTR_TO_BTF_ID | MEM_ALLOC.
 		 */
-		if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type)) {
+		if (atype != BPF_READ &&
+		    (!type_is_ptr_alloc_obj(reg->type) || reg->type & PTR_UNTRUSTED)) {
 			verbose(env, "only read is supported\n");
 			return -EACCES;
 		}
 
 		if (type_is_alloc(reg->type) && !type_is_non_owning_ref(reg->type) &&
-		    !(reg->type & MEM_RCU) && !reg_is_referenced(env, reg)) {
+		    !(reg->type & (MEM_RCU | PTR_UNTRUSTED)) &&
+		    !reg_is_referenced(env, reg)) {
 			verifier_bug(env, "allocated object must have a referenced id");
 			return -EFAULT;
 		}
diff --git a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
index fcf7a7567da2..d7b8cd6458bb 100644
--- a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
+++ b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
@@ -8,14 +8,22 @@
 #include "../bpf_experimental.h"
 #include "bpf_misc.h"
 
+extern void bpf_rcu_read_lock(void) __ksym;
+extern void bpf_rcu_read_unlock(void) __ksym;
+
 struct node_data {
 	long key;
 	long data;
 	struct bpf_rb_node node;
 };
 
+struct plain_data {
+	long key;
+};
+
 struct map_value {
 	struct node_data __kptr *node;
+	struct plain_data __kptr *plain;
 };
 
 struct node_data2 {
@@ -31,6 +39,7 @@ struct node_data2 {
  * [35] TYPE_TAG 'kptr_ref' type_id=34
  */
 struct node_data *just_here_because_btf_bug;
+struct plain_data *just_here_because_btf_bug2;
 
 struct {
 	__uint(type, BPF_MAP_TYPE_ARRAY);
@@ -82,4 +91,53 @@ long drop_rb_node_off(void *ctx)
 	return 0;
 }
 
+SEC("?tc")
+__failure __msg("only read is supported")
+long write_untrusted_alloc_obj(void *ctx)
+{
+	struct map_value *mapval;
+	struct node_data *res;
+	int idx = 0;
+
+	mapval = bpf_map_lookup_elem(&some_nodes, &idx);
+	if (!mapval)
+		return 1;
+
+	bpf_rcu_read_lock();
+	res = mapval->node;
+	if (!res) {
+		bpf_rcu_read_unlock();
+		return 2;
+	}
+	barrier_var(res);
+	bpf_rcu_read_unlock();
+
+	res->key = 42;
+	return 0;
+}
+
+SEC("?tc")
+__success
+long read_untrusted_alloc_obj(void *ctx)
+{
+	struct map_value *mapval;
+	struct plain_data *res;
+	int idx = 0;
+
+	mapval = bpf_map_lookup_elem(&some_nodes, &idx);
+	if (!mapval)
+		return 1;
+
+	bpf_rcu_read_lock();
+	res = mapval->plain;
+	if (!res) {
+		bpf_rcu_read_unlock();
+		return 2;
+	}
+	barrier_var(res);
+	bpf_rcu_read_unlock();
+
+	return res->key;
+}
+
 char _license[] SEC("license") = "GPL";
-- 
2.43.0

Re: [PATCH bpf] bpf: Reject writes through untrusted allocated pointers

[Kumar Kartikeya Dwivedi]

On Tue Jul 28, 2026 at 5:38 AM CEST, Ning Ding wrote:
> A kptr loaded under an RCU read lock has MEM_ALLOC set. After
> bpf_rcu_read_unlock(), the verifier marks it PTR_UNTRUSTED, but
> check_ptr_to_btf_access() still allows writes because
> type_is_ptr_alloc_obj() ignores that flag.
>
> Reject writes through MEM_ALLOC pointers that are PTR_UNTRUSTED. Reads
> remain allowed and are converted to probe-memory accesses.
>
> Also skip the owning-reference check for these pointers, since they no
> longer have a live reference after leaving the RCU critical section.
>
> Add verifier tests for the rejected write and permitted read cases.
>
> Fixes: 503e4def5414 ("bpf: Replace open code with for allocated object check")
> Closes: https://lore.kernel.org/all/20260726021304.97ED91F000E9@smtp.kernel.org/
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Ning Ding <dingning04@gmail.com>
> ---

Same comment for this one, split kernel and selftests into separate patches.

>  kernel/bpf/verifier.c                         |  6 +-
>  .../bpf/progs/local_kptr_stash_fail.c         | 58 +++++++++++++++++++
>  2 files changed, 62 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 7aa47342dc65..24c151ad2e62 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5804,13 +5804,15 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
>  		 * program allocated objects (which always have id > 0),
>  		 * but not for untrusted PTR_TO_BTF_ID | MEM_ALLOC.
>  		 */
> -		if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type)) {
> +		if (atype != BPF_READ &&
> +		    (!type_is_ptr_alloc_obj(reg->type) || reg->type & PTR_UNTRUSTED)) {
>  			verbose(env, "only read is supported\n");
>  			return -EACCES;
>  		}

There is a PTR_UNTRUSTED check already earlier in this function, why is that not
working or not enough?

pw-bot: cr

>
>  		if (type_is_alloc(reg->type) && !type_is_non_owning_ref(reg->type) &&
> -		    !(reg->type & MEM_RCU) && !reg_is_referenced(env, reg)) {
> +		    !(reg->type & (MEM_RCU | PTR_UNTRUSTED)) &&
> +		    !reg_is_referenced(env, reg)) {
>  			verifier_bug(env, "allocated object must have a referenced id");
>  			return -EFAULT;
>  		}
> diff --git a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> index fcf7a7567da2..d7b8cd6458bb 100644
> --- a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> +++ b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> @@ -8,14 +8,22 @@
>  #include "../bpf_experimental.h"
>  #include "bpf_misc.h"
>
> +extern void bpf_rcu_read_lock(void) __ksym;
> +extern void bpf_rcu_read_unlock(void) __ksym;
> +
>  struct node_data {
>  	long key;
>  	long data;
>  	struct bpf_rb_node node;
>  };
>
> +struct plain_data {
> +	long key;
> +};
> +
>  struct map_value {
>  	struct node_data __kptr *node;
> +	struct plain_data __kptr *plain;
>  };
>
>  struct node_data2 {
> @@ -31,6 +39,7 @@ struct node_data2 {
>   * [35] TYPE_TAG 'kptr_ref' type_id=34
>   */
>  struct node_data *just_here_because_btf_bug;
> +struct plain_data *just_here_because_btf_bug2;
>
>  struct {
>  	__uint(type, BPF_MAP_TYPE_ARRAY);
> @@ -82,4 +91,53 @@ long drop_rb_node_off(void *ctx)
>  	return 0;
>  }
>
> +SEC("?tc")
> +__failure __msg("only read is supported")
> +long write_untrusted_alloc_obj(void *ctx)
> +{
> +	struct map_value *mapval;
> +	struct node_data *res;
> +	int idx = 0;
> +
> +	mapval = bpf_map_lookup_elem(&some_nodes, &idx);
> +	if (!mapval)
> +		return 1;
> +
> +	bpf_rcu_read_lock();
> +	res = mapval->node;
> +	if (!res) {
> +		bpf_rcu_read_unlock();
> +		return 2;
> +	}
> +	barrier_var(res);
> +	bpf_rcu_read_unlock();
> +
> +	res->key = 42;
> +	return 0;
> +}
> +
> +SEC("?tc")
> +__success
> +long read_untrusted_alloc_obj(void *ctx)
> +{
> +	struct map_value *mapval;
> +	struct plain_data *res;
> +	int idx = 0;
> +
> +	mapval = bpf_map_lookup_elem(&some_nodes, &idx);
> +	if (!mapval)
> +		return 1;
> +
> +	bpf_rcu_read_lock();
> +	res = mapval->plain;
> +	if (!res) {
> +		bpf_rcu_read_unlock();
> +		return 2;
> +	}
> +	barrier_var(res);
> +	bpf_rcu_read_unlock();
> +
> +	return res->key;
> +}
> +
>  char _license[] SEC("license") = "GPL";

Re: [PATCH bpf] bpf: Reject writes through untrusted allocated pointers

[Ning Ding]

The existing PTR_UNTRUSTED branch is after the access-permission
check. It only handles the case where we propagate the PTR_UNTRUSTED
flag to a field pointer loaded through a BPF_READ. For a direct write
such as res->key = 42, no pointer is loaded and that branch has no
effect:

my_child = res->child; // in that case, my_child will be marked with
PTR_UNTRUSTED, that is what the existing PTR_UNTRUSTED do.
res->key = 42; // The existing check doesn't handle this.

On Sun, Aug 2, 2026 at 4:32 PM Kumar Kartikeya Dwivedi <memxor@gmail.com> wrote:
>
> On Tue Jul 28, 2026 at 5:38 AM CEST, Ning Ding wrote:
> > A kptr loaded under an RCU read lock has MEM_ALLOC set. After
> > bpf_rcu_read_unlock(), the verifier marks it PTR_UNTRUSTED, but
> > check_ptr_to_btf_access() still allows writes because
> > type_is_ptr_alloc_obj() ignores that flag.
> >
> > Reject writes through MEM_ALLOC pointers that are PTR_UNTRUSTED. Reads
> > remain allowed and are converted to probe-memory accesses.
> >
> > Also skip the owning-reference check for these pointers, since they no
> > longer have a live reference after leaving the RCU critical section.
> >
> > Add verifier tests for the rejected write and permitted read cases.
> >
> > Fixes: 503e4def5414 ("bpf: Replace open code with for allocated object check")
> > Closes: https://lore.kernel.org/all/20260726021304.97ED91F000E9@smtp.kernel.org/
> > Assisted-by: Codex:gpt-5.6-sol
> > Signed-off-by: Ning Ding <dingning04@gmail.com>
> > ---
>
> Same comment for this one, split kernel and selftests into separate patches.
>
> >  kernel/bpf/verifier.c                         |  6 +-
> >  .../bpf/progs/local_kptr_stash_fail.c         | 58 +++++++++++++++++++
> >  2 files changed, 62 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 7aa47342dc65..24c151ad2e62 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -5804,13 +5804,15 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
> >                * program allocated objects (which always have id > 0),
> >                * but not for untrusted PTR_TO_BTF_ID | MEM_ALLOC.
> >                */
> > -             if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type)) {
> > +             if (atype != BPF_READ &&
> > +                 (!type_is_ptr_alloc_obj(reg->type) || reg->type & PTR_UNTRUSTED)) {
> >                       verbose(env, "only read is supported\n");
> >                       return -EACCES;
> >               }
>
> There is a PTR_UNTRUSTED check already earlier in this function, why is that not
> working or not enough?
>
> pw-bot: cr
>
> >
> >               if (type_is_alloc(reg->type) && !type_is_non_owning_ref(reg->type) &&
> > -                 !(reg->type & MEM_RCU) && !reg_is_referenced(env, reg)) {
> > +                 !(reg->type & (MEM_RCU | PTR_UNTRUSTED)) &&
> > +                 !reg_is_referenced(env, reg)) {
> >                       verifier_bug(env, "allocated object must have a referenced id");
> >                       return -EFAULT;
> >               }
> > diff --git a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> > index fcf7a7567da2..d7b8cd6458bb 100644
> > --- a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> > +++ b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> > @@ -8,14 +8,22 @@
> >  #include "../bpf_experimental.h"
> >  #include "bpf_misc.h"
> >
> > +extern void bpf_rcu_read_lock(void) __ksym;
> > +extern void bpf_rcu_read_unlock(void) __ksym;
> > +
> >  struct node_data {
> >       long key;
> >       long data;
> >       struct bpf_rb_node node;
> >  };
> >
> > +struct plain_data {
> > +     long key;
> > +};
> > +
> >  struct map_value {
> >       struct node_data __kptr *node;
> > +     struct plain_data __kptr *plain;
> >  };
> >
> >  struct node_data2 {
> > @@ -31,6 +39,7 @@ struct node_data2 {
> >   * [35] TYPE_TAG 'kptr_ref' type_id=34
> >   */
> >  struct node_data *just_here_because_btf_bug;
> > +struct plain_data *just_here_because_btf_bug2;
> >
> >  struct {
> >       __uint(type, BPF_MAP_TYPE_ARRAY);
> > @@ -82,4 +91,53 @@ long drop_rb_node_off(void *ctx)
> >       return 0;
> >  }
> >
> > +SEC("?tc")
> > +__failure __msg("only read is supported")
> > +long write_untrusted_alloc_obj(void *ctx)
> > +{
> > +     struct map_value *mapval;
> > +     struct node_data *res;
> > +     int idx = 0;
> > +
> > +     mapval = bpf_map_lookup_elem(&some_nodes, &idx);
> > +     if (!mapval)
> > +             return 1;
> > +
> > +     bpf_rcu_read_lock();
> > +     res = mapval->node;
> > +     if (!res) {
> > +             bpf_rcu_read_unlock();
> > +             return 2;
> > +     }
> > +     barrier_var(res);
> > +     bpf_rcu_read_unlock();
> > +
> > +     res->key = 42;
> > +     return 0;
> > +}
> > +
> > +SEC("?tc")
> > +__success
> > +long read_untrusted_alloc_obj(void *ctx)
> > +{
> > +     struct map_value *mapval;
> > +     struct plain_data *res;
> > +     int idx = 0;
> > +
> > +     mapval = bpf_map_lookup_elem(&some_nodes, &idx);
> > +     if (!mapval)
> > +             return 1;
> > +
> > +     bpf_rcu_read_lock();
> > +     res = mapval->plain;
> > +     if (!res) {
> > +             bpf_rcu_read_unlock();
> > +             return 2;
> > +     }
> > +     barrier_var(res);
> > +     bpf_rcu_read_unlock();
> > +
> > +     return res->key;
> > +}
> > +
> >  char _license[] SEC("license") = "GPL";
>

Re: [PATCH bpf] bpf: Reject writes through untrusted allocated pointers

[Kumar Kartikeya Dwivedi]

On Mon Aug 3, 2026 at 4:29 AM CEST, Ning Ding wrote:
> The existing PTR_UNTRUSTED branch is after the access-permission
> check. It only handles the case where we propagate the PTR_UNTRUSTED
> flag to a field pointer loaded through a BPF_READ. For a direct write
> such as res->key = 42, no pointer is loaded and that branch has no
> effect:
>
> my_child = res->child; // in that case, my_child will be marked with
> PTR_UNTRUSTED, that is what the existing PTR_UNTRUSTED do.
> res->key = 42; // The existing check doesn't handle this.
>

First, please don't top post.

Second, I don't understand your explanation. WDYM by "after the access
permission check"? It gets invoked for BPF_WRITE, so should be rejecting
res->key = 42 if 'res' is a pointer with PTR_UNTRUSTED flag set. What am I
missing?

> On Sun, Aug 2, 2026 at 4:32 PM Kumar Kartikeya Dwivedi <memxor@gmail.com> wrote:
>>
>> On Tue Jul 28, 2026 at 5:38 AM CEST, Ning Ding wrote:
>> > A kptr loaded under an RCU read lock has MEM_ALLOC set. After
>> > bpf_rcu_read_unlock(), the verifier marks it PTR_UNTRUSTED, but
>> > check_ptr_to_btf_access() still allows writes because
>> > type_is_ptr_alloc_obj() ignores that flag.
>> >
>> > Reject writes through MEM_ALLOC pointers that are PTR_UNTRUSTED. Reads
>> > remain allowed and are converted to probe-memory accesses.
>> >
>> > Also skip the owning-reference check for these pointers, since they no
>> > longer have a live reference after leaving the RCU critical section.
>> >
>> > Add verifier tests for the rejected write and permitted read cases.
>> >
>> > Fixes: 503e4def5414 ("bpf: Replace open code with for allocated object check")
>> > Closes: https://lore.kernel.org/all/20260726021304.97ED91F000E9@smtp.kernel.org/
>> > Assisted-by: Codex:gpt-5.6-sol
>> > Signed-off-by: Ning Ding <dingning04@gmail.com>
>> > ---
>>
>> Same comment for this one, split kernel and selftests into separate patches.
>>
>> >  kernel/bpf/verifier.c                         |  6 +-
>> >  .../bpf/progs/local_kptr_stash_fail.c         | 58 +++++++++++++++++++
>> >  2 files changed, 62 insertions(+), 2 deletions(-)
>> >
>> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> > index 7aa47342dc65..24c151ad2e62 100644
>> > --- a/kernel/bpf/verifier.c
>> > +++ b/kernel/bpf/verifier.c
>> > @@ -5804,13 +5804,15 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
>> >                * program allocated objects (which always have id > 0),
>> >                * but not for untrusted PTR_TO_BTF_ID | MEM_ALLOC.
>> >                */
>> > -             if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type)) {
>> > +             if (atype != BPF_READ &&
>> > +                 (!type_is_ptr_alloc_obj(reg->type) || reg->type & PTR_UNTRUSTED)) {
>> >                       verbose(env, "only read is supported\n");
>> >                       return -EACCES;
>> >               }
>>
>> There is a PTR_UNTRUSTED check already earlier in this function, why is that not
>> working or not enough?
>>
>> pw-bot: cr
>>
>> >
>> >               if (type_is_alloc(reg->type) && !type_is_non_owning_ref(reg->type) &&
>> > -                 !(reg->type & MEM_RCU) && !reg_is_referenced(env, reg)) {
>> > +                 !(reg->type & (MEM_RCU | PTR_UNTRUSTED)) &&
>> > +                 !reg_is_referenced(env, reg)) {
>> >                       verifier_bug(env, "allocated object must have a referenced id");
>> >                       return -EFAULT;
>> >               }
>> > diff --git a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
>> > index fcf7a7567da2..d7b8cd6458bb 100644
>> > --- a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
>> > +++ b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
>> > @@ -8,14 +8,22 @@
>> >  #include "../bpf_experimental.h"
>> >  #include "bpf_misc.h"
>> >
>> > +extern void bpf_rcu_read_lock(void) __ksym;
>> > +extern void bpf_rcu_read_unlock(void) __ksym;
>> > +
>> >  struct node_data {
>> >       long key;
>> >       long data;
>> >       struct bpf_rb_node node;
>> >  };
>> >
>> > +struct plain_data {
>> > +     long key;
>> > +};
>> > +
>> >  struct map_value {
>> >       struct node_data __kptr *node;
>> > +     struct plain_data __kptr *plain;
>> >  };
>> >
>> >  struct node_data2 {
>> > @@ -31,6 +39,7 @@ struct node_data2 {
>> >   * [35] TYPE_TAG 'kptr_ref' type_id=34
>> >   */
>> >  struct node_data *just_here_because_btf_bug;
>> > +struct plain_data *just_here_because_btf_bug2;
>> >
>> >  struct {
>> >       __uint(type, BPF_MAP_TYPE_ARRAY);
>> > @@ -82,4 +91,53 @@ long drop_rb_node_off(void *ctx)
>> >       return 0;
>> >  }
>> >
>> > +SEC("?tc")
>> > +__failure __msg("only read is supported")
>> > +long write_untrusted_alloc_obj(void *ctx)
>> > +{
>> > +     struct map_value *mapval;
>> > +     struct node_data *res;
>> > +     int idx = 0;
>> > +
>> > +     mapval = bpf_map_lookup_elem(&some_nodes, &idx);
>> > +     if (!mapval)
>> > +             return 1;
>> > +
>> > +     bpf_rcu_read_lock();
>> > +     res = mapval->node;
>> > +     if (!res) {
>> > +             bpf_rcu_read_unlock();
>> > +             return 2;
>> > +     }
>> > +     barrier_var(res);
>> > +     bpf_rcu_read_unlock();
>> > +
>> > +     res->key = 42;
>> > +     return 0;
>> > +}
>> > +
>> > +SEC("?tc")
>> > +__success
>> > +long read_untrusted_alloc_obj(void *ctx)
>> > +{
>> > +     struct map_value *mapval;
>> > +     struct plain_data *res;
>> > +     int idx = 0;
>> > +
>> > +     mapval = bpf_map_lookup_elem(&some_nodes, &idx);
>> > +     if (!mapval)
>> > +             return 1;
>> > +
>> > +     bpf_rcu_read_lock();
>> > +     res = mapval->plain;
>> > +     if (!res) {
>> > +             bpf_rcu_read_unlock();
>> > +             return 2;
>> > +     }
>> > +     barrier_var(res);
>> > +     bpf_rcu_read_unlock();
>> > +
>> > +     return res->key;
>> > +}
>> > +
>> >  char _license[] SEC("license") = "GPL";
>>

Re: [PATCH bpf] bpf: Reject writes through untrusted allocated pointers

[Ning Ding]

> Second, I don't understand your explanation. WDYM by "after the access
> permission check"? It gets invoked for BPF_WRITE, so should be rejecting
> res->key = 42 if 'res' is a pointer with PTR_UNTRUSTED flag set. What am I
> missing?

The direct write will pass this earlier permission check since
type_is_ptr_alloc_obj does not check PTR_UNTRUSTED:
if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type))
         return -EACCES;

The later PTR_UNTRUSTED branch is not a rejection check. It means when
accessing a pointer field through an untrusted parent pointer,
propagate PTR_UNTRUSTED to the child pointer.

if (ret != PTR_TO_BTF_ID) {
/* just mark; */

} else if (type_flag(reg->type) & PTR_UNTRUSTED) {
/* If this is an untrusted pointer, all pointers formed by walking it
* also inherit the untrusted flag.
*/
flag = PTR_UNTRUSTED;

}

For res->key = 42, key is a scalar, so ret != PTR_TO_BTF_ID. Therefore
the second branch is skipped and has no effect.

Re: [PATCH bpf] bpf: Reject writes through untrusted allocated pointers

[Kumar Kartikeya Dwivedi]

On Mon Aug 3, 2026 at 5:21 AM CEST, Ning Ding wrote:
>> Second, I don't understand your explanation. WDYM by "after the access
>> permission check"? It gets invoked for BPF_WRITE, so should be rejecting
>> res->key = 42 if 'res' is a pointer with PTR_UNTRUSTED flag set. What am I
>> missing?
>
> The direct write will pass this earlier permission check since
> type_is_ptr_alloc_obj does not check PTR_UNTRUSTED:
> if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type))
>          return -EACCES;
>
> The later PTR_UNTRUSTED branch is not a rejection check. It means when
> accessing a pointer field through an untrusted parent pointer,
> propagate PTR_UNTRUSTED to the child pointer.
>
> if (ret != PTR_TO_BTF_ID) {
> /* just mark; */
>
> } else if (type_flag(reg->type) & PTR_UNTRUSTED) {
> /* If this is an untrusted pointer, all pointers formed by walking it
> * also inherit the untrusted flag.
> */
> flag = PTR_UNTRUSTED;
>
> }
>
> For res->key = 42, key is a scalar, so ret != PTR_TO_BTF_ID. Therefore
> the second branch is skipped and has no effect.

I am talking about this bit before all of that logic:

         if (atype != BPF_READ && (type_flag(reg->type) & PTR_UNTRUSTED)) {
                 verbose(env, "only read is supported\n");
                 return -EACCES;
         }

Why is this not enough? 'key' is scalar, but 'res' which is being written to is
still a PTR_TO_BTF_ID with PTR_UNTRUSTED.

Re: [PATCH bpf] bpf: Reject writes through untrusted allocated pointers

[Ning Ding]

> Why is this not enough? 'key' is scalar, but 'res' which is being written to is
> still a PTR_TO_BTF_ID with PTR_UNTRUSTED.

Ah, right. I was testing against Linus’ master, where that
PTR_UNTRUSTED write check is not present, and I missed that it had
already been added in bpf-next. That patch is not necessary.