From: "Kumar Kartikeya Dwivedi" <memxor@gmail.com>
To: <sashiko-reviews@lists.linux.dev>, <bpf@vger.kernel.org>
Subject: Re: [PATCH bpf-next v2 04/13] bpf: Recognize __nullable on pointer members of kernel structs
Date: Tue, 13 Oct 2026 11:19:12 +0200 [thread overview]
Message-ID: <DM3LKBZS8VU0.1HNORI7HA6FFS@gmail.com> (raw)
In-Reply-To: <sashiko-outbox-169283@kernel.org>
On Tue Oct 13, 2026 at 10:52 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf: MEM_PERCPU pointers are stripped of PTR_MAYBE_NULL flag causing Oops
> --
>
> commit 2e4273929b840decae1764fc52e2d82686a2b6c3
> Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
>
> bpf: Recognize __nullable on pointer members of kernel structs
>
> This patch updates btf_struct_walk() to report the __nullable BTF type tag
> on pointer members as PTR_MAYBE_NULL. The verifier is also modified to keep
> the PTR_MAYBE_NULL flag on trusted and RCU pointers only, under the
> assumption that untrusted results are probed anyway.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 2f190abe34489..a9c47441fba91 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>
> [ ... ]
>
>> @@ -6721,6 +6721,13 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
>> clear_trusted_flags(&flag);
>> }
>>
>> + /*
>> + * A __nullable member only matters where NULL would otherwise be
>> + * assumed away, on trusted and RCU pointers; the rest are probed.
>> + */
>> + if (!(flag & (PTR_TRUSTED | MEM_RCU)))
>> + flag &= ~PTR_MAYBE_NULL;
>> +
>
> [Severity: High]
> Does this unintentionally strip the NULL-checking requirement from
> MEM_PERCPU pointers?
>
> Struct members annotated with __percpu __nullable will receive the
> MEM_PERCPU | PTR_MAYBE_NULL flags from btf_struct_walk(), but lack
> PTR_TRUSTED or MEM_RCU.
>
> Because the pointer loses PTR_MAYBE_NULL here, does the BPF verifier no
> longer force the BPF program to verify it against NULL before passing it to
> helpers like bpf_per_cpu_ptr() or bpf_this_cpu_ptr()?
>
> Since these helpers do not check for NULL internally, calling them with NULL
> simply returns the base address of the CPU's per-CPU memory area. A
> subsequent NULL check by the BPF program would then pass, which might allow
> it to dereference the base of the per-CPU area and corrupt memory.
>
Will just drop the stripping logic, I don't think it makes too much sense and
code is simpler without it.
>> if (atype == BPF_READ && value_regno >= 0) {
>> ret = mark_btf_ld_reg(env, regs, value_regno, ret, reg->btf, btf_id, flag);
>> if (ret < 0)
next prev parent reply other threads:[~2026-10-13 9:19 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-13 8:19 [PATCH bpf-next v2 00/13] Fix some arena paper cuts Kumar Kartikeya Dwivedi
2026-10-13 8:19 ` [PATCH bpf-next v2 01/13] libbpf: Keep the fd_array fill index out of bpf_program__clone() Kumar Kartikeya Dwivedi
2026-10-13 13:00 ` Mykyta Yatsenko
2026-10-13 8:19 ` [PATCH bpf-next v2 02/13] selftests/bpf: Clone a program that calls a module kfunc Kumar Kartikeya Dwivedi
2026-10-13 8:19 ` [PATCH bpf-next v2 03/13] compiler_types: Add __arena and __nullable BTF type tag qualifiers Kumar Kartikeya Dwivedi
2026-10-13 8:19 ` [PATCH bpf-next v2 04/13] bpf: Recognize __nullable on pointer members of kernel structs Kumar Kartikeya Dwivedi
2026-10-13 8:52 ` sashiko-bot
2026-10-13 9:19 ` Kumar Kartikeya Dwivedi [this message]
2026-10-13 8:20 ` [PATCH bpf-next v2 05/13] bpf: Turn loads of __arena pointer members into arena pointers Kumar Kartikeya Dwivedi
2026-10-13 8:40 ` sashiko-bot
2026-10-13 9:04 ` Kumar Kartikeya Dwivedi
2026-10-13 8:20 ` [PATCH bpf-next v2 06/13] selftests/bpf: Test __nullable pointer members Kumar Kartikeya Dwivedi
2026-10-13 8:20 ` [PATCH bpf-next v2 07/13] selftests/bpf: Test __arena " Kumar Kartikeya Dwivedi
2026-10-13 9:14 ` bot+bpf-ci
2026-10-13 9:19 ` Kumar Kartikeya Dwivedi
2026-10-13 8:20 ` [PATCH bpf-next v2 08/13] libbpf: Bind the arena of an object to every program in it Kumar Kartikeya Dwivedi
2026-10-13 9:14 ` bot+bpf-ci
2026-10-13 8:20 ` [PATCH bpf-next v2 09/13] selftests/bpf: Test arena binding by libbpf Kumar Kartikeya Dwivedi
2026-10-13 8:20 ` [PATCH bpf-next v2 10/13] bpf: Set up the arena base only in functions that use it Kumar Kartikeya Dwivedi
2026-10-13 8:20 ` [PATCH bpf-next v2 11/13] libbpf: Render the arena type tag with its address space Kumar Kartikeya Dwivedi
2026-10-13 8:20 ` [PATCH bpf-next v2 12/13] selftests/bpf: Test the address space rendering of the arena type tag Kumar Kartikeya Dwivedi
2026-10-13 8:20 ` [PATCH bpf-next v2 13/13] selftests/bpf: Test an arena kfunc argument passed from a subprogram Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM3LKBZS8VU0.1HNORI7HA6FFS@gmail.com \
--to=memxor@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox