From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D8A33B4EB3 for ; Mon, 3 Aug 2026 11:25:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785756333; cv=none; b=fPbdnQnjAnqsWbZZfxkZjdi/T1aHIuSt+FbFQzw/TqhJSSWdiHnFQmhuT2vSOuWm5WxVbTEOwkorArRi+ODk56jk/KBcTnfbyCbxkVszeQ82dzpIlMUE0bwtjQPviZFRBL0tiWHlHtgw9ptub+O21hzxFjg7I3hgNd1MPo+qiu8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785756333; c=relaxed/simple; bh=Y9AIsjPbIPGueDse8hHLQDqbfy+XindtGyBeUBP/rvM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k0lrnPoOSNV2cgmsFm09UhmeF0Qf31BWnmR+YW0ViMoBsCnKq6lcNejribua/4SLOZTXK7Vxoon0jpHXR+PdesmIxDWbYq9lhgWu2UX6JDR62t3QU0SpL4SrEAvnkr1cKw9b1nHsVAJw5ddIOf3X8SDvJdCxoce6Q3bpQtHtDaM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=S7Ewn73U; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="S7Ewn73U" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so35639695ad.1 for ; Mon, 03 Aug 2026 04:25:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785756332; x=1786361132; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k5tDp607U3XC+GO+sC+Kbg0SxU3/bHhXF0A90r92Gwc=; b=S7Ewn73UrqgDwTQJGK1LAqjznD8pKBeh0BS7XZMFPS474diUB1PCzn8kakXEqN5x9y iEXvYo3mhJJWC/cmHQ4hO5dlg5cZKucC4g7r0SmmzA7od9l4cAmbEP4Yc6lgWyt2rz2x MlbNko9QoRf2vC0BpG56ReCP2wuk6wfx9Bp4WYmP0oQXcyUpCfxZ7d1aehAhU7YpJI7T ipHHOg1MtWxDbILdaVWXCVXLkwXtOFRaE9iyZsu6PMqtBHLmyY3Ki6V3dr9uYnrzMt8c xC7zHwAcoRp9G9tZbSCcYlCfdM50EtckpzS07hA6r3zyYJsFhqfU3mbACKqJTZAE0sU8 zQnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785756332; x=1786361132; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=k5tDp607U3XC+GO+sC+Kbg0SxU3/bHhXF0A90r92Gwc=; b=h+S9wNH31IIitE7rqumurzdTOFqLhRN8r6aM1HMmfvo5Swf8IJoaPVGCaalmkgE3D3 SdsK9a9TZ/9rCeG0Qyd4r+wjO+mKkdcoirXrGk7HgaWDJk81pqcPpwnw4WJ7PA08Jk71 QdeK2WRiFVICc02hl9y6t93WImrFCr6fZOi1Eu/ll+u1UJyg+VmRr7HKO9Mj0aw5Z3zq 2iAJxgN8yzfBC79SbGp5nYonbILJZJT2T71pnAgxLxhhueG2ISz98UcU0zkwbrktZeCb aL2v93gujzHFRg5vLFf6m3Pp7HCYeZm3RNSSgPyzS1LdYIL8A9SerAXu1Jl3U1KNRw+R 2KaQ== X-Forwarded-Encrypted: i=1; AHgh+RolvvMm3rU6Ufoo0EifYY3N9EHhggVQGvrf/7gGtmpF/9yS9vrIL0tQYqcqsyphVZoQLSSSfbEELBwBkoo=@vger.kernel.org X-Gm-Message-State: AOJu0YynIGBa5SFCD5khNlBCCKwcSrMQsU0L+9o6jANiXSrSTJG/tGo1 QcaBkRWi4f619odE1Ji3F/SGSybJzLAbykXo9x4rlXkZGYDPEunf1dsx X-Gm-Gg: AR+sD13Ozf1JCKYl2n/fhjpqxGX3pEdegL5FpQln1GXy8TVSsC4yffT+jufkx8zCBzQ 7PdZ6Y/4HlmR+JHlmmlxgGvg/A7QcCKsDcU9PEkvBiCe99Zi/xDfj6xeLv3eCAQhm4ZUnL968zy LO0h6T7hzQlQ56s1ladq7g/MVI190KtTSkMRXtY7pvKEdqkr+0TWR9y6KCesQtUrjE94yJOpfV9 6waY4VY5NEzBgYzrtangEXKe03vU9Z2X1C56m3tW5vEnxgcBZCBASKP9/Kkaj0ngdbhJBZxvAe2 pddhJXioW2/Xm195HowG9buQuIRQMExsFfZfZJt8HkoO48TGxOyHFnzk3jR7YJ5+8OT1DADg+6P voKweDCB1idoe5knlTQYjwjQ9Ga/q83f2zNnvbE7HrwFSrPh1Y2klrGdFQsIC7nPAlBMwejEcoc dRe/h6BCYojhcWk93MErPqR2rbg9qZFmqHOOMdJ+yTN6UrcQtZT5G8DH5HtNSDZVcruQG80AfMw 3Cmnc28yi3zLb/c X-Received: by 2002:a17:903:1a06:b0:2ca:d172:7228 with SMTP id d9443c01a7336-2d0521b6908mr100228275ad.11.1785756331838; Mon, 03 Aug 2026 04:25:31 -0700 (PDT) Received: from patterson.cs.ubc.ca (patterson.cs.ubc.ca. [198.162.52.65]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d04ae5a91asm36190685ad.21.2026.08.03.04.25.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Aug 2026 04:25:31 -0700 (PDT) From: Ning Ding To: bpf@vger.kernel.org Cc: memxor@gmail.com, greg@kroah.com, Ning Ding , stable@vger.kernel.org, Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Dave Marchevsky , linux-kernel@vger.kernel.org Subject: [PATCH bpf v3 1/4] bpf: Keep refcount_acquire nullable for borrowed RCU kptrs Date: Mon, 3 Aug 2026 04:22:08 -0700 Message-ID: <20260803112218.3361213-2-dingning04@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260803112218.3361213-1-dingning04@gmail.com> References: <20260803112218.3361213-1-dingning04@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The verifier can mistake an RCU-loaded map kptr for an owned reference and assume bpf_refcount_acquire() cannot return NULL. The kfunc uses refcount_inc_not_zero(), so it can return NULL after the last reference is dropped. Passing that unchecked result to bpf_obj_drop() can crash the kernel. Only treat the argument as owned when the verifier tracks an acquired reference for it. Borrowed pointers remain nullable, while owned pointers keep the existing behavior. Fixes: 1b12171533a9 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.5 Assisted-by: ChatGPT:GPT-5.6-Thinking Signed-off-by: Ning Ding --- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index fdc5fbb1f78ca..c47328be2505e 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12419,7 +12419,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ reg_arg_name(env, argno)); return -EINVAL; } - if (!type_is_non_owning_ref(reg->type)) + if (!type_is_non_owning_ref(reg->type) && reg_is_referenced(env, reg)) meta->arg_owning_ref = true; rec = reg_btf_record(reg); -- 2.43.0