On Tue Jul 28, 2026 at 5:38 AM CEST, Ning Ding wrote:
> A kptr loaded under an RCU read lock has MEM_ALLOC set. After
> bpf_rcu_read_unlock(), the verifier marks it PTR_UNTRUSTED, but
> check_ptr_to_btf_access() still allows writes because
> type_is_ptr_alloc_obj() ignores that flag.
>
> Reject writes through MEM_ALLOC pointers that are PTR_UNTRUSTED. Reads
> remain allowed and are converted to probe-memory accesses.
>
> Also skip the owning-reference check for these pointers, since they no
> longer have a live reference after leaving the RCU critical section.
>
> Add verifier tests for the rejected write and permitted read cases.
>
> Fixes: 503e4def5414 ("bpf: Replace open code with for allocated object check")
> Closes:
> https://lore.kernel.org/all/[email protected]/
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Ning Ding <[email protected]>
> ---
Same comment for this one, split kernel and selftests into separate patches.
> kernel/bpf/verifier.c | 6 +-
> .../bpf/progs/local_kptr_stash_fail.c | 58 +++++++++++++++++++
> 2 files changed, 62 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 7aa47342dc65..24c151ad2e62 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5804,13 +5804,15 @@ static int check_ptr_to_btf_access(struct
> bpf_verifier_env *env,
> * program allocated objects (which always have id > 0),
> * but not for untrusted PTR_TO_BTF_ID | MEM_ALLOC.
> */
> - if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type)) {
> + if (atype != BPF_READ &&
> + (!type_is_ptr_alloc_obj(reg->type) || reg->type &
> PTR_UNTRUSTED)) {
> verbose(env, "only read is supported\n");
> return -EACCES;
> }
There is a PTR_UNTRUSTED check already earlier in this function, why is that not
working or not enough?
pw-bot: cr
>
> if (type_is_alloc(reg->type) &&
> !type_is_non_owning_ref(reg->type) &&
> - !(reg->type & MEM_RCU) && !reg_is_referenced(env, reg)) {
> + !(reg->type & (MEM_RCU | PTR_UNTRUSTED)) &&
> + !reg_is_referenced(env, reg)) {
> verifier_bug(env, "allocated object must have a
> referenced id");
> return -EFAULT;
> }
> diff --git a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> index fcf7a7567da2..d7b8cd6458bb 100644
> --- a/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> +++ b/tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c
> @@ -8,14 +8,22 @@
> #include "../bpf_experimental.h"
> #include "bpf_misc.h"
>
> +extern void bpf_rcu_read_lock(void) __ksym;
> +extern void bpf_rcu_read_unlock(void) __ksym;
> +
> struct node_data {
> long key;
> long data;
> struct bpf_rb_node node;
> };
>
> +struct plain_data {
> + long key;
> +};
> +
> struct map_value {
> struct node_data __kptr *node;
> + struct plain_data __kptr *plain;
> };
>
> struct node_data2 {
> @@ -31,6 +39,7 @@ struct node_data2 {
> * [35] TYPE_TAG 'kptr_ref' type_id=34
> */
> struct node_data *just_here_because_btf_bug;
> +struct plain_data *just_here_because_btf_bug2;
>
> struct {
> __uint(type, BPF_MAP_TYPE_ARRAY);
> @@ -82,4 +91,53 @@ long drop_rb_node_off(void *ctx)
> return 0;
> }
>
> +SEC("?tc")
> +__failure __msg("only read is supported")
> +long write_untrusted_alloc_obj(void *ctx)
> +{
> + struct map_value *mapval;
> + struct node_data *res;
> + int idx = 0;
> +
> + mapval = bpf_map_lookup_elem(&some_nodes, &idx);
> + if (!mapval)
> + return 1;
> +
> + bpf_rcu_read_lock();
> + res = mapval->node;
> + if (!res) {
> + bpf_rcu_read_unlock();
> + return 2;
> + }
> + barrier_var(res);
> + bpf_rcu_read_unlock();
> +
> + res->key = 42;
> + return 0;
> +}
> +
> +SEC("?tc")
> +__success
> +long read_untrusted_alloc_obj(void *ctx)
> +{
> + struct map_value *mapval;
> + struct plain_data *res;
> + int idx = 0;
> +
> + mapval = bpf_map_lookup_elem(&some_nodes, &idx);
> + if (!mapval)
> + return 1;
> +
> + bpf_rcu_read_lock();
> + res = mapval->plain;
> + if (!res) {
> + bpf_rcu_read_unlock();
> + return 2;
> + }
> + barrier_var(res);
> + bpf_rcu_read_unlock();
> +
> + return res->key;
> +}
> +
> char _license[] SEC("license") = "GPL";
