Files
linux/include/linux
Ning Ding 7441ee8276 bpf: Reject untrusted allocated-object pointers
When the final RCU read-side critical section ends, a local kptr is demoted
to PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer
to an object whose lifetime is no longer protected.

type_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with
MEM_ALLOC as a live allocated object. In particular, a refcount-only local
kptr never carries NON_OWN_REF, so it still passes the
bpf_refcount_acquire() argument check after RCU protection ends. The kfunc
can then dereference NULL or stale memory.

Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since
type_is_non_owning_ref() is based on the same predicate, graph kfunc
arguments obey the same live-object requirement. Fault-protected reads of
the demoted pointer remain valid: writes are already rejected, and read
fixups use bpf_may_fault_on_deref() rather than this predicate.

Fixes: 1b12171533 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref")
Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Ning Ding <dingning04@gmail.com>
[ kkd: Rewrote commit log ]
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-8-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04 07:58:36 -07:00
..
2026-07-23 10:24:12 -07:00
2026-08-07 14:18:13 -03:00
2026-04-02 15:52:49 +02:00
2026-05-21 13:04:42 +02:00
2026-03-19 23:55:27 +01:00
2026-05-28 21:24:54 -07:00
2026-08-10 18:00:47 +01:00
2026-07-29 17:54:58 -07:00
2026-04-03 16:53:50 -04:00
2026-06-29 10:31:53 +02:00
2026-08-15 23:36:18 +02:00
2026-06-07 10:03:01 -07:00
2026-07-27 16:25:34 +02:00
2026-06-30 10:56:52 +02:00
2026-07-07 15:10:48 -04:00
2026-05-28 17:45:46 -07:00
2026-07-09 15:48:53 -07:00
2026-06-05 00:34:55 -04:00
2026-05-18 11:16:29 +02:00
2026-05-19 17:26:07 +02:00
2026-05-28 11:36:59 -04:00
2026-04-07 17:38:07 +02:00
2026-02-27 16:40:16 +01:00
2026-06-05 17:46:17 -07:00
2026-05-28 21:24:43 -07:00
2026-06-10 10:42:55 -04:00
2026-04-05 13:53:28 -07:00
2026-04-01 10:19:41 +02:00
2026-07-31 10:09:12 +02:00
2026-04-03 16:53:50 -04:00
2026-03-18 09:59:57 +00:00
2026-04-05 13:53:00 -07:00
2026-03-08 11:06:53 +01:00
2026-07-23 15:42:48 +02:00
2026-08-12 16:24:26 +02:00
2026-06-26 22:18:34 -04:00
2026-03-27 07:35:05 -07:00
2026-04-05 13:53:10 -07:00
2026-04-20 11:35:17 -07:00
2026-02-27 16:40:16 +01:00
2026-07-23 19:21:13 +01:00
2026-03-08 11:06:53 +01:00
2026-03-31 07:04:00 -06:00
2026-08-15 23:36:18 +02:00
2026-07-27 17:18:00 +02:00
2026-03-13 08:22:54 +01:00
2026-05-11 16:59:43 +02:00
2026-03-12 15:05:34 +01:00
2026-06-06 15:22:44 +02:00