Re: [PATCH v2] bpf: fix NULL pointer dereference in print_reg_state()

[KaFai Wan <kafai.wan@linux.dev>]

On Fri, 2025-09-26 at 06:34 +0530, Brahmajit Das wrote:
> On 25.09.2025 23:31, KaFai Wan wrote:
> > On Wed, 2025-09-24 at 23:58 +0530, Brahmajit Das wrote:
> > > On 25.09.2025 01:38, KaFai Wan wrote:
> > > > On Wed, 2025-09-24 at 21:10 +0530, Brahmajit Das wrote:
> > > > > On 24.09.2025 09:32, Alexei Starovoitov wrote:
> > > > > > On Wed, Sep 24, 2025 at 1:43 AM Brahmajit Das
> > > > > > <listout@listout.xyz>
> > > > > > wrote:
> > > > > > > 
> > > > > > > Syzkaller reported a general protection fault due to a
> > > > > > > NULL
> > > > > > > pointer
> > > > > > > dereference in print_reg_state() when accessing reg-
> > > > > > > >map_ptr
> > > > > > > without
> > > > > > > checking if it is NULL.
> > > > > > > 
> ...snip...
> > > > 
> > > > Looks like we're getting somewhere.
> > > > It seems the verifier is not clearing reg->type.
> > > > adjust_scalar_min_max_vals() should be called on scalar types
> > > > only.
> > > 
> > > Right, there is a check in check_alu_op
> > > 
> > > 		if (is_pointer_value(env, insn->dst_reg)) {
> > > 			verbose(env, "R%d pointer arithmetic
> > > prohibited\n",
> > > 				insn->dst_reg);
> > > 			return -EACCES;
> > > 		}
> > > 
> > > is_pointer_value calls __is_pointer_value which takes bool
> > > allow_ptr_leaks as the first argument. Now for some reason in
> > > this
> > > case
> > > allow_ptr_leaks is being passed as true, as a result
> > > __is_pointer_value
> > > (and in turn is_pointer_value) returns false when even when
> > > register
> > > type is CONST_PTR_TO_MAP.
> > > 
> > 
> > IIUC, `env->allow_ptr_leaks` set true means privileged mode (
> > CAP_PERFMON or CAP_SYS_ADMIN ), false for unprivileged mode. 
> > 
> > 
> > We can use __is_pointer_value to check if the register type is a
> > pointer. For pointers, we check as before (before checking BPF_NEG
> > separately), and for scalars, it remains unchanged. Perhaps this
> > way we
> > can fix the error.
> > 
> > if (opcode == BPF_NEG) {
> > 	if (__is_pointer_value(false, &regs[insn->dst_reg])) {
> > 		err = check_reg_arg(env, insn->dst_reg, DST_OP);
> > 	} else {
> > 		err = check_reg_arg(env, insn->dst_reg,
> > DST_OP_NO_MARK);
> > 		err = err ?: adjust_scalar_min_max_vals(env, insn,
> > 						&regs[insn-
> > >dst_reg],
> > 						regs[insn-
> > >dst_reg]);
> > 	}
> > } else {
> > 
> > 
> > -- 
> > Thanks,
> > KaFai
> 
> Yep, that works.
> 
Ok
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -15505,10 +15505,17 @@ static int check_alu_op(struct
> bpf_verifier_env *env, struct bpf_insn *insn)
> 
>                 /* check dest operand */
>                 if (opcode == BPF_NEG) {
> -                       err = check_reg_arg(env, insn->dst_reg,
> DST_OP_NO_MARK);
> -                       err = err ?: adjust_scalar_min_max_vals(env,
> insn,
> -                                                        &regs[insn-
> >dst_reg],
> -                                                        regs[insn-
> >dst_reg]);
> +                       if (__is_pointer_value(false, &regs[insn-
> >dst_reg])) {
> +                               err = check_reg_arg(env, insn-
> >dst_reg, DST_OP);
> +                       } else {
> +                               err = check_reg_arg(env, insn-
> >dst_reg,
> +                                                   DST_OP_NO_MARK);
> +                               err = err   ?:
> +                                            
> adjust_scalar_min_max_vals(
> +                                                     env, insn,
> +                                                     &regs[insn-
> >dst_reg],
> +                                                     regs[insn-
> >dst_reg]);
> +                       }
>                 } else {
>                         err = check_reg_arg(env, insn->dst_reg,
> DST_OP);
>                 }
> 

We can make code cleaner and change just one line for all.

if (opcode == BPF_NEG && !__is_pointer_value(false, &regs[insn-
>dst_reg])) {
	err = check_reg_arg(env, insn->dst_reg, DST_OP_NO_MARK);
	err = err ?: adjust_scalar_min_max_vals(env, insn,
					 &regs[insn->dst_reg],
					 regs[insn->dst_reg]);
} else {
	err = check_reg_arg(env, insn->dst_reg, DST_OP);
}

> 
> I'll just wait for other developer or Alexei, in case they have any
> feedback before sending a v3.
> 

You should add a Fixes label in the commit log and add selftest for it
in V3. 
Fixes label is Fixes: aced132599b3 ("bpf: Add range tracking for
BPF_NEG")
For selftest you may check the test in verifier_value_illegal_alu.c and
other files.  

The code in your next post would change the behavior of BPF_NEG and 
BPF_END, you can run the selftest to check that.


The email I sent last time was rejected by the mail server because it
was in HTML format，sorry for that.
-- 
Thanks,
KaFai