Re: [PATCH bpf-next v4 05/12] bpf: Refactor object relationship tracking and fix dynptr UAF bug

[Eduard Zingerman <eddyz87@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2919 bytes --]

On Wed, 2026-05-06 at 07:27 -0700, Amery Hung wrote:

[...]

> +/* Release id and objects referencing the id iteratively in a DFS manner */
> +static int release_reference(struct bpf_verifier_env *env, int id)
> +{
> +	u32 mask = (1 << STACK_SPILL) | (1 << STACK_DYNPTR);
>  	struct bpf_verifier_state *vstate = env->cur_state;
> +	struct bpf_idmap *idstack = &env->idmap_scratch;
> +	struct bpf_stack_state *stack;
>  	struct bpf_func_state *state;
>  	struct bpf_reg_state *reg;
> -	int err;
> +	int root_id = id, err;
>  
> -	err = release_reference_nomark(vstate, ref_obj_id);
> -	if (err)
> -		return err;
> +	idstack->cnt = 0;
> +	idstack_push(idstack, id);
>  
> -	bpf_for_each_reg_in_vstate(vstate, state, reg, ({
> -		if (reg->ref_obj_id == ref_obj_id)
> -			mark_reg_invalid(env, reg);
> -	}));
> +	if (find_reference_state(vstate, id))
> +		WARN_ON_ONCE(release_reference_nomark(vstate, id));
> +
> +	while ((id = idstack_pop(idstack))) {
> +		bpf_for_each_reg_in_vstate_mask(vstate, state, reg, stack, mask, ({
> +			int ref_obj_cnt = 1;
> +
> +			if (reg->id != id && reg->parent_id != id && reg->ref_obj_id != id)
> +				continue;
> +
> +			/*
> +			 * A referenced dynptr can be overwritten only if there is at
> +			 * least one other dynptr sharing the same ref_obj_id,
> +			 * ensuring the reference can still be properly released.
> +			 */
> +			if (stack && stack->slot_type[BPF_REG_SIZE - 1] == STACK_DYNPTR &&
> +			    dynptr_type_referenced(reg->dynptr.type))
> +				ref_obj_cnt = dynptr_get_refcnt(state, reg->ref_obj_id);

Note that dynptr_get_refcnt() only looks for objects in the state's frame,
dynptrs in other frames are ignored. This can lead to false rejections,
as in the attached test cases, which verifier refuses to load with the
following error message:

; *(volatile __u8 *)&clone = 0; @ dynptr_fail.c:2160
19: (73) *(u8 *)(r10 -16) = r1
Leaking reference id=2 alloc_insn=7. Release it first.
processed 14 insns (limit 1000000) max_states_per_insn 1 total_states 1 peak_states 1 mark_read 0

> +
> +			if (reg->ref_obj_id && reg->ref_obj_id != root_id && ref_obj_cnt <= 1) {
> +				struct bpf_reference_state *ref_state;
> +
> +				ref_state = find_reference_state(env->cur_state, reg->ref_obj_id);
> +				verbose(env, "Leaking reference id=%d alloc_insn=%d. Release it first.\n",
> +					ref_state->id, ref_state->insn_idx);
> +				return -EINVAL;
> +			}
> +
> +			/* Free objects derived from the current object */
> +			if (reg->id != id) {
> +				err = idstack_push(idstack, reg->id);
> +				if (err)
> +					return err;
> +			}
> +
> +			if (!stack || stack->slot_type[BPF_REG_SIZE - 1] == STACK_SPILL)
> +				mark_reg_invalid(env, reg);
> +			else if (stack->slot_type[BPF_REG_SIZE - 1] == STACK_DYNPTR)
> +				invalidate_dynptr(env, stack);
> +		}));
> +	}
>  
>  	return 0;
>  }

[...]

[-- Attachment #2: false-positivie-test.patch --]
[-- Type: text/x-patch, Size: 1116 bytes --]

diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
index 31962233bea1..e308b0409530 100644
--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
+++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
@@ -2150,3 +2150,33 @@ int dynptr_overwrite_ref_clone_slice_valid(void *ctx)
 
 	return 0;
 }
+
+static __noinline void overwrite_clone_in_callee(struct bpf_dynptr *parent)
+{
+	struct bpf_dynptr clone;
+
+	bpf_dynptr_clone(parent, &clone);
+	/* Overwrite the clone - parent in caller frame still holds the ref */
+	*(volatile __u8 *)&clone = 0;
+}
+
+/*
+ * Overwriting a clone in a callee frame should be allowed when the parent
+ * in the caller frame still holds the ref. dynptr_get_refcnt() currently
+ * only counts dynptrs in the current frame, missing the parent in the
+ * caller frame.
+ */
+SEC("?raw_tp")
+__success
+int dynptr_overwrite_clone_cross_frame(void *ctx)
+{
+	struct bpf_dynptr ptr;
+
+	bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
+
+	overwrite_clone_in_callee(&ptr);
+
+	bpf_ringbuf_discard_dynptr(&ptr, 0);
+
+	return 0;
+}