bpf: Reject a store through a fault prone pointer

check_ptr_to_btf_access() allows the program to store before the default
BTF access path gets to reject a non read access. ac65c710cc ("bpf:
Reject writes through untrusted BTF pointers") closed that for a
PTR_UNTRUSTED pointer, but a bare PTR_TO_BTF_ID may fault on a dereference
just the same and is let through.

A BPF_LDX gets the BPF_PROBE_MEM rewrite in bpf_convert_ctx_accesses()
and a bad address is handled, but a BPF_STX does not and cannot, there
is no probed store to rewrite. The store is emitted as a plain one without
an exception table entry and a bad address panics the kernel.

A bpf_qdisc program can reach this, bpf_qdisc_btf_struct_access() permits a
write to Qdisc::limit and Qdisc::next_sched is a plain struct Qdisc pointer
which the walk turns into the compat type:

  struct Qdisc *next = sch->next_sched;

  next->limit = 1000;

  BUG: kernel NULL pointer dereference, address: 0000000000000014
  RIP: 0010:bpf_prog_c6e14e7f32c8e325_bpf_fifo_enqueue+0x3a/0x12b
  Code: [...] bf e8 03 00 00 <89> 7e 14 41 8b 7f 14 [...]
  Kernel panic - not syncing: Fatal exception in interrupt

Fix by widen the check to bpf_may_fault_on_deref() so that it covers both.

Fixes: 27ae7997a6 ("bpf: Introduce BPF_PROG_TYPE_STRUCT_OPS")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260814215301.709827-3-daniel@iogearbox.net

kernel/bpf/verifier.c

@@ -5988,7 +5988,7 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 		return -EACCES;
 	}
 
-	if (atype != BPF_READ && (type_flag(reg->type) & PTR_UNTRUSTED)) {
+	if (atype != BPF_READ && bpf_may_fault_on_deref(reg->type)) {
 		verbose(env, "only read is supported\n");
 		return -EACCES;
 	}