bpf: reject direct access to nullable PTR_TO_BUF pointers

check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check.

Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference.

Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:bpf_prog_5f0e2be830ac3243_null_deref_iter+0x10/0x25
  Call Trace:
   bpf_iter_run_prog+0x1c2/0x2e0
   __bpf_hash_map_seq_show+0x120/0x180
   bpf_seq_read+0x29c/0x530
   vfs_read+0x179/0x930
   ksys_read+0xef/0x1c0
   do_syscall_64+0xe0/0x1290
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  Kernel panic - not syncing: Fatal exception

---
Changes in v2:
- Add selftest

---
 kernel/bpf/verifier.c                         |  3 +-
 .../selftests/bpf/progs/iter_buf_null_fail.c  | 49 +++++++++++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/progs/iter_buf_null_fail.c

index 937c9adf1b3d..17850836943b 100644
@@ -7905,7 +7905,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 	} else if (reg->type == CONST_PTR_TO_MAP) {
 		err = check_ptr_to_map_access(env, regs, regno, off, size, t,
 					      value_regno);
-	} else if (base_type(reg->type) == PTR_TO_BUF) {
+	} else if (base_type(reg->type) == PTR_TO_BUF &&
+		   !type_may_be_null(reg->type)) {
 		bool rdonly_mem = type_is_rdonly_mem(reg->type);
 		u32 *max_access;
 

2.43.0

Just this much info is enough, please drop the stack trace from the commit log.

The fix looks fine, but please split the kernel fix and selftests into separate patches.
E.g. look at this series:
https://lore.kernel.org/bpf/[email protected]
Also, use the subject prefix [PATCH bpf ...] for v3.

pw-bot: cr