Re: [PATCH bpf 1/2] bpf: Fix NULL-ptr-deref when dumping a key-less BTF hash map

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Fri Aug 28, 2026 at 12:51 PM CEST, Jiayuan Chen wrote:
>
> on 8/28/26 5:54 PM, sashiko-bot@kernel.org wrote:
>> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>>
>> Pre-existing issues:
>> - [High] btf_modifier_show dereferences NULL when a modifier resolves to a void type.
>> --
>>
>> commit 36dc7c26f56375bd142801da1fcbc83e4a765c35
>> Author: Jiayuan Chen <jiayuan.chen@linux.dev>
>>
>> bpf: Fix NULL-ptr-deref when dumping a key-less BTF hash map
>>
>> This patch fixes a NULL pointer dereference in btf_type_show() that occurs
>> when dumping a key-less BTF hash map. It restores previous behavior by
>> rejecting key-less BTF in hash map check callbacks, and adds a NULL check
>> for void types in btf_type_show() to gracefully handle any other paths.
>>
>> Reported-by: syzbot+37b56485bbbf90ad8489@syzkaller.appspotmail.com
>> Closes: https://lore.kernel.org/all/6a8f4e88.27659fcc.2ceef7.0008.GAE@google.com/T/
>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>>
>>> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>>> index da36d4b9d31ab..c32265dc4ae7e 100644
>>> --- a/kernel/bpf/btf.c
>>> +++ b/kernel/bpf/btf.c
>>> @@ -8229,6 +8229,10 @@ static void btf_type_show(const struct btf *btf, u32 type_id, void *obj,
>>>   	memset(&show->state, 0, sizeof(show->state));
>>>   	memset(&show->obj, 0, sizeof(show->obj));
>>>
>>> +	/* A void type (e.g. type_id 0) has no show op, don't deref NULL. */
>>> +	if (!t || !btf_type_ops(t))
>>> +		return;
>>> +
>>>   	btf_type_ops(t)->show(btf, t, type_id, obj, 0, show);
>>>   }
>> [Severity: High]
>> This is a pre-existing issue, but does this fix need to be extended to
>> btf_modifier_show() as well?
>>
>> If a user with BPF tracing privileges invokes the bpf_snprintf_btf() helper
>> with a btf_id of a modifier that points to void (e.g., const void),
>> btf_type_show() will see the modifier type and pass this check since
>> modifier_ops is not NULL.
>
>
> Right, good catch. Passing a "const void" type_id to bpf_snprintf_btf()
> resolves to
>
> void in btf_modifier_show() and hits the same NULL deref, which the
> check here does not cover.
>
> Shoud I add the fix in this patchset since they are all about "show"
> semantics?

It would make sense to include a fix in v2 together with this, but in case of
bpf_snprintf_btf(), we should still print something for such type id, right?