Re: [PATCH v2] bpf: fix NULL pointer dereference in print_reg_state()

[Brahmajit Das]

On 25.09.2025 23:31, KaFai Wan wrote:
> On Wed, 2025-09-24 at 23:58 +0530, Brahmajit Das wrote:
> > On 25.09.2025 01:38, KaFai Wan wrote:
> > > On Wed, 2025-09-24 at 21:10 +0530, Brahmajit Das wrote:
> > > > On 24.09.2025 09:32, Alexei Starovoitov wrote:
> > > > > On Wed, Sep 24, 2025 at 1:43 AM Brahmajit Das
> > > > > <listout@xxxxxxxxxxx>
> > > > > wrote:
> > > > > > 
> > > > > > Syzkaller reported a general protection fault due to a NULL
> > > > > > pointer
> > > > > > dereference in print_reg_state() when accessing reg->map_ptr
> > > > > > without
> > > > > > checking if it is NULL.
> > > > > > 
...snip...
> > > 
> > > Looks like we're getting somewhere.
> > > It seems the verifier is not clearing reg->type.
> > > adjust_scalar_min_max_vals() should be called on scalar types only.
> > 
> > Right, there is a check in check_alu_op
> > 
> > 		if (is_pointer_value(env, insn->dst_reg)) {
> > 			verbose(env, "R%d pointer arithmetic
> > prohibited\n",
> > 				insn->dst_reg);
> > 			return -EACCES;
> > 		}
> > 
> > is_pointer_value calls __is_pointer_value which takes bool
> > allow_ptr_leaks as the first argument. Now for some reason in this
> > case
> > allow_ptr_leaks is being passed as true, as a result
> > __is_pointer_value
> > (and in turn is_pointer_value) returns false when even when register
> > type is CONST_PTR_TO_MAP.
> > 
> 
> IIUC, `env->allow_ptr_leaks` set true means privileged mode (
> CAP_PERFMON or CAP_SYS_ADMIN ), false for unprivileged mode. 
> 
> 
> We can use __is_pointer_value to check if the register type is a
> pointer. For pointers, we check as before (before checking BPF_NEG
> separately), and for scalars, it remains unchanged. Perhaps this way we
> can fix the error.
> 
> if (opcode == BPF_NEG) {
> 	if (__is_pointer_value(false, &regs[insn->dst_reg])) {
> 		err = check_reg_arg(env, insn->dst_reg, DST_OP);
> 	} else {
> 		err = check_reg_arg(env, insn->dst_reg,
> DST_OP_NO_MARK);
> 		err = err ?: adjust_scalar_min_max_vals(env, insn,
> 						&regs[insn->dst_reg],
> 						regs[insn->dst_reg]);
> 	}
> } else {
> 
> 
> -- 
> Thanks,
> KaFai

Yep, that works.

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15505,10 +15505,17 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)

                /* check dest operand */
                if (opcode == BPF_NEG) {
-                       err = check_reg_arg(env, insn->dst_reg, DST_OP_NO_MARK);
-                       err = err ?: adjust_scalar_min_max_vals(env, insn,
-                                                        &regs[insn->dst_reg],
-                                                        regs[insn->dst_reg]);
+                       if (__is_pointer_value(false, &regs[insn->dst_reg])) {
+                               err = check_reg_arg(env, insn->dst_reg, DST_OP);
+                       } else {
+                               err = check_reg_arg(env, insn->dst_reg,
+                                                   DST_OP_NO_MARK);
+                               err = err   ?:
+                                             adjust_scalar_min_max_vals(
+                                                     env, insn,
+                                                     &regs[insn->dst_reg],
+                                                     regs[insn->dst_reg]);
+                       }
                } else {
                        err = check_reg_arg(env, insn->dst_reg, DST_OP);
                }

I'll just wait for other developer or Alexei, in case they have any
feedback before sending a v3.

-- 
Regards,
listout