Re: [PATCH bpf-next v2 04/13] bpf: Recognize __nullable on pointer members of kernel structs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: MEM_PERCPU pointers are stripped of PTR_MAYBE_NULL flag causing Oops
--

commit 2e4273929b840decae1764fc52e2d82686a2b6c3
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Recognize __nullable on pointer members of kernel structs

This patch updates btf_struct_walk() to report the __nullable BTF type tag
on pointer members as PTR_MAYBE_NULL. The verifier is also modified to keep
the PTR_MAYBE_NULL flag on trusted and RCU pointers only, under the
assumption that untrusted results are probed anyway.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 2f190abe34489..a9c47441fba91 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -6721,6 +6721,13 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
>  		clear_trusted_flags(&flag);
>  	}
>  
> +	/*
> +	 * A __nullable member only matters where NULL would otherwise be
> +	 * assumed away, on trusted and RCU pointers; the rest are probed.
> +	 */
> +	if (!(flag & (PTR_TRUSTED | MEM_RCU)))
> +		flag &= ~PTR_MAYBE_NULL;
> +

[Severity: High]
Does this unintentionally strip the NULL-checking requirement from
MEM_PERCPU pointers?

Struct members annotated with __percpu __nullable will receive the
MEM_PERCPU | PTR_MAYBE_NULL flags from btf_struct_walk(), but lack
PTR_TRUSTED or MEM_RCU.

Because the pointer loses PTR_MAYBE_NULL here, does the BPF verifier no
longer force the BPF program to verify it against NULL before passing it to
helpers like bpf_per_cpu_ptr() or bpf_this_cpu_ptr()?

Since these helpers do not check for NULL internally, calling them with NULL
simply returns the base address of the CPU's per-CPU memory area. A
subsequent NULL check by the BPF program would then pass, which might allow
it to dereference the base of the per-CPU area and corrupt memory.

>  	if (atype == BPF_READ && value_regno >= 0) {
>  		ret = mark_btf_ld_reg(env, regs, value_regno, ret, reg->btf, btf_id, flag);
>  		if (ret < 0)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013082012.1107446-1-memxor@gmail.com?part=4