Re: [PATCH bpf-next v4 1/2] bpf: Enforce trusted BTF ID argument provenance

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: check_func_arg() allows PTR_UNTRUSTED | MEM_RCU into KF_RCU kfuncs
--

commit 1e71cf476e59d8805f3765efcab69f9c9d9bba4a
Author: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>

bpf: Enforce trusted BTF ID argument provenance

This commit modifies the verifier to make the provenance check contract-driven
by marking generated BTF ID kfunc argument types with PTR_TRUSTED and explicitly
adding MEM_RCU only for KF_RCU kfuncs. It uses the normalized type for modifier
checks while reference lookup uses the original register.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 353bde9ae2274..a0ab793f041d8 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -9605,8 +9614,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p
>  			}
>  		}
>  
> -		if (is_kfunc(meta) && (!is_trusted_reg(env, reg) ||
> -				       bpf_type_has_unsafe_modifiers(reg->type))) {
> +		reg_type = reg->type & ~(arg_type & PTR_MAYBE_NULL);
> +		if ((arg_type & PTR_TRUSTED) &&
> +		    (!is_trusted_reg_type(env, reg, reg_type) ||
> +		     bpf_type_has_unsafe_modifiers(reg_type))) {
>  			if (!(arg_type & MEM_RCU)) {
[ ... ]
>  				return -EINVAL;
>  			}
>  			if (!is_rcu_reg(reg)) {
[ ... ]
>  				return -EINVAL;
>  			}
>  		}

[Severity: High]
Does this allow a register with both MEM_RCU and PTR_UNTRUSTED modifiers to be
passed into KF_RCU kfuncs?

If a BPF program loads a pointer that is marked as PTR_UNTRUSTED | MEM_RCU (for
example, when loading an __rcu pointer embedded in a union) inside an RCU
critical section, and passes it to a KF_RCU kfunc:

1. The arg_type has MEM_RCU, so the first inner check !(arg_type & MEM_RCU) is
   false.
2. The register has MEM_RCU, so the second inner check !is_rcu_reg(reg) is
   false.
3. The validation falls through and succeeds, even though the register has the
   PTR_UNTRUSTED modifier.

Since check_reg_type() bypasses the strict compatible_reg_types check for kfunc
BTF_ID arguments, this appears to leave the verifier without any checks that
would reject the untrusted modifier here. Can this result in untrusted garbage
pointers being used as valid RCU pointers?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007-a3-arg-trusted-v4-v4-0-253ef3a1a69a@mails.tsinghua.edu.cn?part=1