Commit b0db1acc authored by Qi Tang's avatar Qi Tang Committed by Alexei Starovoitov
Browse files

bpf: reject direct access to nullable PTR_TO_BUF pointers 



check_mem_access() matches PTR_TO_BUF via base_type() which strips
PTR_MAYBE_NULL, allowing direct dereference without a null check.

Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL.
On stop callbacks these are NULL, causing a kernel NULL dereference.

Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the
existing PTR_TO_BTF_ID pattern.

Fixes: 20b2aff4 ("bpf: Introduce MEM_RDONLY flag")
Signed-off-by: default avatarQi Tang <tpluszz77@gmail.com>
Acked-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260402092923.38357-2-tpluszz77@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent ad8391d3

kernel/bpf/verifier.c

+2 −1
Original line number Diff line number Diff line
@@ -7905,7 +7905,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn 
	} else if (reg->type == CONST_PTR_TO_MAP) {

		err = check_ptr_to_map_access(env, regs, regno, off, size, t,

					      value_regno);

	} else if (base_type(reg->type) == PTR_TO_BUF) {

	} else if (base_type(reg->type) == PTR_TO_BUF &&

		   !type_may_be_null(reg->type)) {

		bool rdonly_mem = type_is_rdonly_mem(reg->type);

		u32 *max_access;