Fix bpf_loop syzbot report

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing negative bounds checks for enum array indices in memcg BPF kfuncs (bpf_mem_cgroup_memory_events and bpf_mem_cgroup_vm_events). --

commit 3f8d69cede626ae022617ccb30f54b8f41f90edd
Author: Kumar Kartikeya Dwivedi <[email protected]>

bpf: Reject non-scalar bpf_loop iteration counts

This commit fixes a verifier warning and subsequent panic triggered when pointer values are passed to the bpf_loop() nr_loops argument. It introduces ARG_SCALAR to ensure generic helper argument validation rejects pointers before loop inlining and precision processing.

Link https://lore.kernel.org/bpf/[email protected]/ open here

include/linux/bpf.h enum bpf_arg_type { · line 897

Quoted 9 lines

include/linux/bpf.h +1 -0

index 3a7eb2185c354..591dfab3e706c 100644
@@ -894,6 +894,7 @@ enum bpf_arg_type {
 
 	ARG_PTR_TO_CTX,		/* pointer to context */
 	ARG_ANYTHING,		/* any (initialized) argument is ok */
+	ARG_SCALAR,		/* scalar argument */

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the addition of ARG_SCALAR and how the verifier handles scalar arguments, a pre-existing missing bounds check was noticed in the memory cgroup kfuncs.

Could negative enum values passed by untrusted BPF programs cause an out-of-bounds read in the memcg BPF kfuncs?

Looking at mm/bpf_memcontrol.c:bpf_mem_cgroup_memory_events():

	if (unlikely(event >= MEMCG_NR_MEMORY_EVENTS))
		return (unsigned long)-1;

	return atomic_long_read(&memcg->memory_events[event]);

And similarly in mm/bpf_memcontrol.c:bpf_mem_cgroup_vm_events(), which exposes validation logic from mm/memcontrol.c:memcg_vm_event_item_valid():

	if (idx >= NR_VM_EVENT_ITEMS)
		return false;

	return !BAD_STAT_IDX(memcg_events_index(idx));

Because the BPF verifier enforces scalar types but does not validate enum ranges, a BPF program can pass a negative integer as the event parameter. The bounds checks use signed comparisons without a lower bound (< 0) check, so negative values will bypass the validation (e.g., -1 >= 4 evaluates to false).

Can this lead to an out-of-bounds array access on kernel memory when the negative value is used as an index into memcg->memory_events?

bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks.

Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic.

Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing.

Fixes bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations")

Reported-by [email protected]

Closes https://lore.kernel.org/bpf/[email protected]/ open here

Signed-off-by Kumar Kartikeya Dwivedi <[email protected]>

---

Add a verifier test that leaves the raw tracepoint context pointer in R1 when calling bpf_loop(). This is the smallest trigger for the incorrect precision backtracking: it reuses an existing callback and needs no maps or userspace setup.

Expect an ordinary scalar-type rejection. Without the verifier fix, the test instead reaches precision backtracking and reports an internal "backtracking misuse" error.

Signed-off-by Kumar Kartikeya Dwivedi <[email protected]>

---