From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f54.google.com (mail-dl1-f54.google.com [74.125.82.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E714D21ABAA for ; Mon, 1 Jun 2026 19:32:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780342369; cv=none; b=nrfk6ugOZSzsRL+GgkT8SPfYo82SrxmY2H8mJEyeq+wHfdF2+cTgsq+aT+IwNC6VnqayayWMX77Iqc+GwcdMcD4uroPiDsAGuRWMECrdEKJgcks5Bu3JuCt8L3C/RZM2VX+xRBq/X8d9tvCHdTTJOf4DSjJgW1m8AbVwBV8oSHA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780342369; c=relaxed/simple; bh=uI9DbOztookQPi1QWPJTS5KmX6M4fBE1cxesgsindMU=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=YLc6bDmBLoTztEBdwEH0JFD6xnjcwvZle8UQCQH0a2Mlg82F4Sjyu1G+4oXOql25eD7Ty5Y9cL7pFyzFY/E/OGUFeYz0CMxKb7M+V/utyfpIe4iqNWaNuG9geSpbbnCcB0B09P2MN9uKkKqkGUoOlFl2kCfaupJtsX9s+Jt9Ra0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=L1dlb21V; arc=none smtp.client-ip=74.125.82.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="L1dlb21V" Received: by mail-dl1-f54.google.com with SMTP id a92af1059eb24-137dd523634so2588555c88.1 for ; Mon, 01 Jun 2026 12:32:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780342367; x=1780947167; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=FmqPrAiaAyI+otBp62Udjj0SCzt/zY61VVnyRHk6LmQ=; b=L1dlb21VHLzaM96Gn9tmOCSJ5IGasLVKXuzutzOsZTQQe8706CTVgt4K5zaeKreIIZ WtKI7BXgXHUb3CiyacFG45FK8ckyFolEZzYqEwQYxwc8ODf4qu9LTUm48McNbV6ZmnPM 5VarzM0cLyGM+NbL/0YttI/eZpnkuqB0GAUQ5qJOtFODOcHU+bNSAEKHJFkfK3CWHMT+ H35AdnPruPZKbwuiXkoRvAVep44Pc/qh5/+JEC7AJjcWR4cxd+hPbIIR6eAkCdR5q3lr TiHKZEnwyhuG+D12+ht1XIep9gJHNtr3ctdUxXGrEQuu+k5k1cKKZULMDiX6JWyvgxaO ZvWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780342367; x=1780947167; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=FmqPrAiaAyI+otBp62Udjj0SCzt/zY61VVnyRHk6LmQ=; b=aEPaL+BZbOnIKWZ3ZX/xbLL80FVDLvAyt7Dxbduka9IwNnYd0n9i9M5QHLUhodOH/B +sDzgQkSjQS9vKLpPzzSGR99wnI+3O3U7F8R092/SdGEgKNwGS4W35LL3ZjDdMimbkHj q7JygBJwrjzPjpMpNgkxI6zoW3q7lMJJEMrSOo1StIO0OP0tBEs8L8AiWqik43Iyu5NJ bQ9oGgOuIciMAqRypNTDw9RgibaICzTFsE/Xbz4FjVL2sd2CwXxbFGIGo5su+rGD+LJt 8JfBvB5p/bGKJh7LPLR/d518pAtqt+AdDVRy9LpfnxtefTPjAp+D0+r2/ki3C3omEmcM RkVw== X-Forwarded-Encrypted: i=1; AFNElJ9C7J+4Nu42DhKBGs+4FPKbeCpSxllBO9cISzt7OhHpJBPU4OYA0Vx6RStHy/Y2orxnjZ72FITH3sE5sgM=@vger.kernel.org X-Gm-Message-State: AOJu0YwE17AFac+iIAXLfD+aXj1XaxBt8FWjyrxupukEfPnp6TDbD+be dUmqI70IdrkwsOt2qjpv/ipYvlQQJaY2cRuMtIG0bdmW7U29SEMHljAx X-Gm-Gg: Acq92OF3as8SGp3XT5n5XN/wPQ7SGZ4BWqqeAzzG5FBJNC62sdfRnqjnHGzKz8GCfpn wJrYTDZDgRgygs5gd7xwxVSqXzBzCO2i3TUnIY3TAO0W93EP8EOpETQ+Uy1j9lfu2748K6lFA7V l7suhzeJIRB+yMKFXfkRadz5lu+dzxTTPshBOaoWajc2i9X0Y+NJ9Gc1LkswGraqorzbv9eNslh 90Gdozo+WIO+wW92up6mW+jPRfOQxkHiDG8LH9/BBO/3vt2Hu3NdiWyehzs2IJPu5SDXj19KVeV HAW9u3tSVVjGA3omEaOg+rqSfUYdh4wm13Ia8ajeUvucLfTHOAIViBL8YfgzKXUA2tmE9OzIZTe A41HAVoOFZM10/8TL8BooXGxyvHBufYVCD4UIYU/hzTZDwKdicy6huLcscDdp/VL5W9yw7LE3UM 5nAnNhlwGjOdedzHvpsqnZ1zMv9kdJ3u6JxNrkEKdDZ2Oc1ZcvarWmy1fQNHFaQEfa3oPJxGkKe p3UVNx8xvIHyQ== X-Received: by 2002:a05:7022:e03:b0:137:6781:7dd4 with SMTP id a92af1059eb24-137d3bf3c9emr5514136c88.8.1780342366978; Mon, 01 Jun 2026 12:32:46 -0700 (PDT) Received: from ?IPv6:2a03:83e0:115c:1:af92:b4b2:3f30:fe90? ([2620:10d:c090:500::96]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-137b37cd5basm7662619c88.8.2026.06.01.12.32.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2026 12:32:46 -0700 (PDT) Message-ID: <535798105630b24033f33f532051b93dc853bc0d.camel@gmail.com> Subject: Re: [PATCH bpf v2 1/2] bpf: Fix kfunc implicit arg inject type detection to prevent invalid pointer deref From: Eduard Zingerman To: bot+bpf-ci@kernel.org, chenyuan_fl@163.com Cc: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org, chenyuan@kylinos.cn, daniel@iogearbox.net, jolsa@kernel.org, linux-kernel@vger.kernel.org, martin.lau@linux.dev, memxor@gmail.com, song@kernel.org, yonghong.song@linux.dev, martin.lau@kernel.org, clm@meta.com, ihor.solodrai@linux.dev Date: Mon, 01 Jun 2026 12:32:44 -0700 In-Reply-To: References: <20260601064611.807637-2-chenyuan_fl@163.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.60.1 (3.60.1-1.fc44) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Mon, 2026-06-01 at 07:42 +0000, bot+bpf-ci@kernel.org wrote: > > bpf: Fix kfunc implicit arg inject type detection to prevent invalid po= inter deref > >=20 > > When a module kfunc declares an implicit struct bpf_prog_aux * argument= , > > the verifier must identify it so the kernel injects env->prog->aux into > > the correct register at runtime. The original check used > > is_kfunc_arg_prog_aux() which calls btf_types_are_same() to compare the > > module BTF type against vmlinux. > >=20 > > Root Cause > > ---------- > >=20 > > This issue was triggered by pahole 1.30 generating module BTF with > > incorrect type information, which caused the kernel's distilled base > > BTF deduplication for modules to fail. As a result, the module retaine= d > > its own copy of struct bpf_prog_aux with a different BTF ID than > > vmlinux's definition. While pahole 1.31 fixed the BTF generation issue= , > > the kernel must be robust against such inconsistencies: a BTF mismatch > > should result in a clean rejection, not a kernel crash or information > > disclosure. > >=20 > > When the distilled base dedup fails and btf_types_are_same() cannot > > match the module's bpf_prog_aux type against vmlinux's, > > is_kfunc_arg_prog_aux() returned false and the code fell through > > silently without setting arg_prog. The kfunc then received whatever > > value was in the argument register and dereferenced it as a > > bpf_prog_aux pointer, leading to: > >=20 > > =C2=A0=C2=A0BUG: kernel invalid pointer dereference, address: 000000000= 00009e2 > > =C2=A0=C2=A0RIP: bpf_prog_get_assoc_struct_ops+0xa/0xc0 > > =C2=A0=C2=A0RDI: 0x000000000000046d (stale register value) > >=20 > > In the observed crash the stale value was the process PID, causing a > > dereference within the unmapped NULL page. However, an attacker able > > to control the register value -- for example by writing a BPF program > > that explicitly sets R2 before calling a KF_IMPLICIT_ARGS kfunc -- > > could redirect the dereference to arbitrary kernel memory, turning > > this into an information disclosure. The fix ensures the verifier > > either validates and injects the correct bpf_prog_aux pointer, or > > rejects the program outright -- no silent fallthrough that could > > be exploited. >=20 > This looks like a fix for a real bug, but it does not carry a Fixes: > tag. Should it point at the change that introduced the implicit > prog_aux argument handling, is_kfunc_arg_prog_aux() and KF_ARG_PROG_AUX_I= D? >=20 > That code appears to come from "bpf: Support __magic prog_aux arguments > for kfuncs" (Ihor Solodrai, lore message-id > 20251029190113.3323406-5-ihor.solodrai@linux.dev). >=20 > The merged SHA could not be resolved from this repository, so the tag > would need to be filled in by hand, for example: >=20 > =C2=A0=C2=A0Fixes: ("bpf: Support __magic prog_aux arguments for kf= uncs") >=20 >=20 > --- > AI reviewed your patch. Please fix the bug or email reply why it's not a = bug. > See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/READM= E.md >=20 > CI run summary: https://github.com/kernel-patches/bpf/actions/runs/267401= 41551 The robot (and b4 utility as well) is confused by the following formatting quirk: > ... > Fix > --- > ... The triple dash marks the start of the diff section of the patch. Hence, when I apply this series the commit message is truncated after this point.