Commit 766bf026 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'bpf-fix-null-deref-when-storing-scalar-into-kptr-slot' 



Mykyta Yatsenko says:

====================
bpf: Fix NULL deref when storing scalar into kptr slot

map_kptr_match_type() accesses reg->btf before confirming the register
is PTR_TO_BTF_ID. A scalar store into a kptr slot has no btf, causing
a NULL pointer dereference. Guard base_type() first.

Signed-off-by: default avatarMykyta Yatsenko <yatsenko@meta.com>
====================

Link: https://patch.msgid.link/20260416-kptr_crash-v1-0-5589356584b4@meta.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents e5f635ed fcd11ff8

kernel/bpf/verifier.c

+4 −1
Original line number Diff line number Diff line
@@ -4549,6 +4549,9 @@ static int map_kptr_match_type(struct bpf_verifier_env *env, 
	int perm_flags;

	const char *reg_name = "";









	if (base_type(reg->type) != PTR_TO_BTF_ID)









		goto bad_type;

















	if (btf_is_kernel(reg->btf)) {









		perm_flags = PTR_MAYBE_NULL | PTR_TRUSTED | MEM_RCU;
















@@ -4561,7 +4564,7 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,







			perm_flags |= MEM_PERCPU;









	}

















	if (base_type(reg->type) != PTR_TO_BTF_ID || (type_flag(reg->type) & ~perm_flags))









	if (type_flag(reg->type) & ~perm_flags)









		goto bad_type;

















	/* We need to verify reg->type and reg->btf, before accessing reg->btf */
































tools/testing/selftests/bpf/progs/map_kptr_fail.c



+15
−0






























Original line number
Diff line number
Diff line







@@ -385,4 +385,19 @@ int kptr_xchg_possibly_null(struct __sk_buff *ctx)







	return 0;









}



















SEC("?tc")









__failure __msg("invalid kptr access, R")









int reject_scalar_store_to_kptr(struct __sk_buff *ctx)









{









	struct map_value *v;









	int key = 0;



















	v = bpf_map_lookup_elem(&array_map, &key);









	if (!v)









		return 0;



















	*(volatile u64 *)&v->unref_ptr = 0xBADC0DE;









	return 0;









}



















char _license[] SEC("license") = "GPL";