From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F057B47010D for ; Thu, 13 Aug 2026 21:16:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786655805; cv=none; b=CUb83vccMR6+fah6/I9ku3EcqTBpph0EQdIISNi5oS9/Prae2HYYcBnagYsfUHwXeYQT6O1upAsthFFBPuXdbjLhm2GnK0guaFW0rHCe0FbBrWEHFKqW+ChRz81m9QU0Nube2Nt7dBallpkdbc5U1krjcqdV6vuQjv5nvy2yY80= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786655805; c=relaxed/simple; bh=YI6nSUoGi0iWVXo8QuXc1GyKW5TZx4UEiyEf8E+2JhQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RAINiDxvqbnv62SOXREbDL7AQsdYKgZ3pKNk14ZFuw56BVuON1eJaYAFWO6RijD0E/p3YQsTs2NUug6vjB6AQmH0l6x+E9ZhWAdn6ZJJfkbjR0VkBqmf5ZaJ9Np+BHRiCnkUkH+PRMx16WNYiQUY2AIP3MQFgguqm4ADx2TAjIg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pAf5cS2B; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pAf5cS2B" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so298450a91.2 for ; Thu, 13 Aug 2026 14:16:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786655789; x=1787260589; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FMLot0g5Zyb+UKRiaCOHwz95HCsQzvZPkHit+OYwsqU=; b=pAf5cS2Bp8KYI30RHzN68OqHlIOojFRrqnGyqRMtlTUABZeTiZhTRtfmR6ZZbwQS7N EgUm6xNZPsNUwMMVHwSUMZ8jL1c8UxIUFfP0OgBnGTavbrhBokDeUE6Q1gRhr+tNascj 4b1jbTNm3h33c9hmZ4NU5AQAK4dT+6aFnv2Zz34BYfFArqH08sED6acF/5v2bIC3c1XI LneuJXOR2T2ljAhJTNu37s7WPrcWQEWvquxi3nZWMch4Ko2XtxpZGONvun526c/y0yXZ rpBjXXfSSGDOHY2zAt86LCsEno1yVnMiGxOO7Dx9CDiY8KQrEg/Bt1Lg9gFDHmX4w2tN TNBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786655789; x=1787260589; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=FMLot0g5Zyb+UKRiaCOHwz95HCsQzvZPkHit+OYwsqU=; b=tCHbMxUKe9txLN1EWeuClJnQeSRlNYLCwsctKrJ6neP/S8Nt3Bzqv3Lg/CWctkKhwx eOtJLXSTSRpxFgoMr1yeQDnxdTwkK+ZbYTQTMUcS0bIzShkYiKta1m45FE2v/v1h6avi G3/PNEmS002aT+ApZJZYwp1UqtprdhC3pSgPnRTjpNytA5/h1ZVVj26F+wX07YPfsLQY v5u8vTCzNrY9RvPFcO0baEMa6KvYuvhVvRVU2rW0JktiS64ll61Y9G+8MPOWKxe/hDD6 4zeH68QvVGFA1/JCzieydgCRntV24tGcesMKO5Vt460GDGjlJ6LnRIFhazpM/VSCWvvx wd7A== X-Forwarded-Encrypted: i=1; AHgh+RqcxpiaW4wqu46cw9/AX9boBtNtkNXWhAcUAyPW1lA5m+0u4yCUDzIsG7EP4J5fRfMNK9E2dOP8VOgon3s=@vger.kernel.org X-Gm-Message-State: AOJu0YxwiN5lkeRK97yp3KJEUidPnT9DU/DkSr7OssGCTTF9G0b9V/9z fEW2RQsDXp5qdcSkwSqwysRMzQ2tN4pCwwew7YxttIjF/LiQQOBlJfnn09v5Zw== X-Gm-Gg: AR+sD10gZ7QmrZXnuTZsb+DyxLf40IWRKCSuwWsosVxzfqMD1CUGNEm7pkHRZOBiOT6 BU3d0PQSFleMFhapEjuaU8TyCtSSxQQQH1gZLl/+tgARsqj3hPpFGuIOlaUJDeLfCcQliZWp7RC sJC/nAog7Ry08WBUKa1+jaa0NGgVGU8I/xbzFNMtaKfRS1WJtwUx+hAMFdPIkEJ4O48zVsGS6JN tDZylFnP4+ykJ9mnRk4JH9LSFPaHAZPTmgynwELXcgWldw6fBEowVl4vuwXVuTWdXlCqe3nryzn cCnDRDvZVqSi4c5tDr90/Wm+19dsXNgC8vJs7RrHAJTuL4hw0UKhC6Y1f5MNg8DwDvmIxz+srOj Nxj/5FKsWMHo3jGGEgMDqQ8f+4PBOhIMvFqAH4XJ0ldNe3LOzNRxVETnYEy+YcvHhi3n+m4nt/L 26TgCcU+b4EwC9t3dljHbpUp+hddL6MWw+Sa+AGujGmXkNqa8uuovSSNE1WaIwjwun9Srm+m/94 kP3N3243bDo9bPg X-Received: by 2002:a17:90b:3d45:b0:37f:fd1f:d30f with SMTP id 98e67ed59e1d1-3933b9157eemr889344a91.12.1786655788490; Thu, 13 Aug 2026 14:16:28 -0700 (PDT) Received: from patterson.cs.ubc.ca (patterson.cs.ubc.ca. [198.162.52.65]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3933a03e288sm853985a91.17.2026.08.13.14.16.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 14:16:28 -0700 (PDT) From: Ning Ding To: bpf@vger.kernel.org Cc: memxor@gmail.com, greg@kroah.com, dingning04@gmail.com, Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Dave Marchevsky , linux-kernel@vger.kernel.org Subject: [PATCH bpf-next v4 1/4] bpf: Keep refcount_acquire nullable for borrowed RCU kptrs Date: Thu, 13 Aug 2026 14:15:23 -0700 Message-ID: <20260813211533.290256-2-dingning04@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260813211533.290256-1-dingning04@gmail.com> References: <20260813211533.290256-1-dingning04@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The verifier can mistake an RCU-loaded map kptr for an owned reference and assume bpf_refcount_acquire() cannot return NULL. The kfunc uses refcount_inc_not_zero(), so it can return NULL after the last reference is dropped. Passing that unchecked result to bpf_obj_drop() can crash the kernel. Only treat the argument as owned when the verifier tracks an acquired reference for it. Borrowed pointers remain nullable, while owned pointers keep the existing behavior. Fixes: 1b12171533a9 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref") Assisted-by: Codex:gpt-5.5 Assisted-by: ChatGPT:GPT-5.6-Thinking Signed-off-by: Ning Ding --- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6ac1afced20b..bc021c8c8fbf 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12482,7 +12482,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me reg_arg_name(env, argno)); return -EINVAL; } - if (!type_is_non_owning_ref(reg->type)) + if (!type_is_non_owning_ref(reg->type) && reg_is_referenced(env, reg)) meta->arg_owning_ref = true; rec = reg_btf_record(reg); -- 2.43.0