Re: [PATCH bpf-next v2 05/13] bpf: Turn loads of __arena pointer members into arena pointers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: PROBE_MEM fault bypass via non-nullable __arena pointers
--

commit fdb573c7b91be34110bf569fb46f6159ad42b9b8
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Turn loads of __arena pointer members into arena pointers

This commit translates the loads of __arena tagged pointer members in
kernel structs into arena pointers during verification. If the member
is also tagged as __nullable, a NULL test is kept before subtracting
the arena base address.

> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
> index b2fa7e8bedf3a..3c95b6c8bbbc5 100644
> --- a/kernel/bpf/fixups.c
> +++ b/kernel/bpf/fixups.c
[ ... ]
> @@ -870,6 +870,36 @@ int bpf_opt_subreg_zext_lo32_rnd_hi32(struct bpf_verifier_env *env,
>   *     struct __sk_buff    -> struct sk_buff
>   *     struct bpf_sock_ops -> struct sock
>   */
> +/*
> + * A load through an __arena pointer member of a kernel struct reads the kernel
> + * address of arena memory. Append the conversion to the arena pointer form,
[ ... ]
> +static int arena_member_fixup(struct bpf_verifier_env *env, int idx, struct bpf_insn *insn,
> +			      struct bpf_insn *buf)
> +{
> +	struct bpf_insn_aux_data *aux = &env->insn_aux_data[idx];
> +	int cnt = 0;
> +	u32 base;
> +
> +	if (!aux->arena_member)
> +		return 0;
> +	if (aux->non_arena_load) {
> +		verbose(env, "an insn loads an arena pointer member on one path and something else on another\n");
> +		return -EINVAL;
> +	}
> +
> +	base = bpf_arena_get_kern_vm_start(env->prog->aux->arena);
> +	buf[cnt++] = *insn;
> +	if (aux->arena_member_nullable)
> +		buf[cnt++] = BPF_JMP_IMM(BPF_JEQ, insn->dst_reg, 0, 1);
> +	buf[cnt++] = BPF_ALU32_IMM(BPF_SUB, insn->dst_reg, (s32)base);

[Severity: High]
Could this allow a bypass of the PROBE_MEM zeroing mechanism when a fault
occurs on a non-nullable arena pointer?

If a PROBE_MEM read of a non-nullable __arena pointer faults, the exception
handler zeroes the destination register and resumes execution at the next
instruction. Because the pointer lacks __nullable, the zero-check branch
is omitted and the BPF_SUB instruction executes unconditionally.

This executes on the zeroed register, changing its value to -(u32)base.
Since base (kern_vm_start) is page-aligned but shifted by GUARD_SZ / 2 (32KB),
the truncated 32-bit offset calculates to 4GB - (base % 4GB). This
consistently points to the next 4GB-aligned address in the kernel.

Because base % 4GB is at least 32KB, this mathematically guarantees the
address falls strictly within the 4GB valid, user-mapped bounds of the arena.
Could an attacker map this arena offset, populate it with a malicious
payload, and spoof the BPF program into using attacker-controlled data?

> +	return cnt;
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013082012.1107446-1-memxor@gmail.com?part=5