Changes in snprintf_btf_void.c

2beb1b31a12b57e19cd5c82ea6d54e56520605e8 - Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Sun, 06 Sep 2026 22:49:44 +0200

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfPull bpf fixes from Alexei Starovoitov: "This mainly contains verifier fixes that address bugs reported by Nicholas Carlini. - Fix incorrect non-NULL inference in pointer comparisons: pointer types that may be NULL at runtime, pointers with unbounded offsets, JMP32 comparisons with zero, and imprecise zero registers (Eduard Zingerman) - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind implicit subprog exit, bpf_loop() callbacks, linked scalar ids and NULL call arguments (Eduard Zingerman) - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall patterns entered by a jump (Eduard Zingerman) - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs (Hui Su) - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types, and reject key-less BTF for hash maps (Jiayuan Chen) - Various fixes (Kumar Kartikeya Dwivedi): - Fix out-of-bounds access in disassembler on invalid LDSX instruction - mark siginfo of signal tracepoints as scalar and sched_process_wait argument as nullable - mark faultable stack helpers as sleepable - reject tail calls and legacy packet loads from callbacks - enforce rbtree callback lock restrictions for resilient locks - require MEM_PERCPU for percpu kptr stores - clear NON_OWN_REF after RCU protection ends - mark NULL kptr stores precise - preserve inner map identity in callback frames - reject non-scalar bpf_loop() iteration counts - Fix trampoline allocation slowdown on x86 by using EXECMEM_MODULE_DATA (Mike Rapoport) - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and reject untrusted allocated-object pointers (Ning Ding) - Fix special fields handling in recycled rhtab elements (Nuoqi Gui, Yuan Chen)"* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits) bpf, riscv: Make arena support depend on ZACAS selftests/bpf: Test pointer bpf_loop iteration count rejection bpf: Reject non-scalar bpf_loop iteration counts bpf: use mark_arg_precision() in check_mem_size_reg() bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() selftests/bpf: precision of a NULL global subprogram BTF_ID argument bpf: mark a NULL BTF_ID argument of a global subprogram precise selftests/bpf: precision of a NULL kfunc argument bpf: mark a NULL kfunc argument precise selftests/bpf: precision of a NULL global subprogram memory argument bpf: mark a NULL memory argument of a call precise selftests/bpf: precision of a NULL helper argument bpf: mark a NULL call argument precise selftests/bpf: Test inner map identities in callbacks bpf: Preserve inner map identity in callback frames selftests/bpf: Test imprecise scalar kptr stores bpf: Mark NULL kptr stores precise selftests/bpf: Test rhtab kptr cancellation semantics bpf: Cancel special fields when recycling rhtab elements selftests/bpf: Test timer field on recycled rhtab element ... List of files: /linux/tools/testing/selftests/bpf/progs/snprintf_btf_void.c

1329a7aa33848c6f7e01eec9b9985086a44647d2 - Merge branch 'bpf-fix-null-ptr-derefs-when-showing-a-void-btf-type'

Thu, 03 Sep 2026 18:31:52 +0200

Merge branch 'bpf-fix-null-ptr-derefs-when-showing-a-void-btf-type'Jiayuan Chen says:====================bpf: Fix NULL-ptr-derefs when showing a void BTF typeThis series fixes three NULL-ptr-derefs in BTF handling.Patch 1 handles the syzbot report. A key-less BTF (btf_key_type_id == 0) usedto be rejected for hash maps, until htab and rhtab gained a ->map_check_btf(to register a dtor) that does not look at the key, so a key-less hash map isnow accepted. Dumping it through bpffs feeds the key type_id 0 intobtf_type_seq_show() and NULL-derefs in btf_type_show(). Reject it again.Patches 2 and 3 fix two related, pre-existing crashes reachable viabpf_snprintf_btf(), which renders a type_id taken straight from the BPFprogram against the vmlinux BTF. A "const void" (a modifier resolving tovoid) NULL-derefs in btf_modifier_show() - void has no ->show op; aBTF_KIND_VAR NULL-derefs in btf_var_show() - the vmlinux base BTF has noresolved_ids. Patch 2 falls back to btf_df_show(), the ""placeholder already used for FWD/FUNC/FLOAT/DECL_TAG; patch 3 resolves thevar's type directly, mirroring the existing guard in btf_modifier_show().Patches 4 and 5 add selftests. Patch 4 checks a key-less hash and rhash map isrejected at creation. Patch 5 extends the snprintf_btf test to render a"const void" and a BTF_KIND_VAR from the vmlinux BTF and checks they resolvewithout crashing.v3 -> v4: Drop the pin-and-read reproducer from the key-less map test, foldthe void/VAR test into the existing snprintf_btf test, and simplify patch 2'swording (review comments).v2 -> v3: Fold in a third fix for the same class of bug, btf_var_show(),reported while reviewing v2. Address review comments (Fixes attribution,verbatim syzbot trace, skip instead of fail).v1 -> v2: AI reported a pre-exist issue. Let's fold it in this series.v3: https://lore.kernel.org/bpf/20260831110314.150870-1-jiayuan.chen@linux.dev/v2: https://lore.kernel.org/bpf/20260830073242.148092-1-jiayuan.chen@linux.dev/v1: https://lore.kernel.org/bpf/20260828093142.179856-1-jiayuan.chen@linux.dev/====================Link: https://patch.msgid.link/20260901104924.346187-1-jiayuan.chen@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/snprintf_btf_void.c

1ae6aa61958a0ee6f254cefbee20663ffbadb195 - selftests/bpf: Add test for showing a void BTF type

Tue, 01 Sep 2026 12:47:39 +0200

selftests/bpf: Add test for showing a void BTF typeExtend the snprintf_btf test with type_ids from the vmlinux BTF thatused to NULL-deref in the BTF show path: a "const void", checked torender the "" placeholder, and a BTF_KIND_VAR,checked to resolve and render without error.The program renders from its own buffer and the test picks a VAR whoseresolved type fits it, so the render stays in bounds.Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260901104924.346187-6-jiayuan.chen@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/snprintf_btf_void.c