Re: [PATCH bpf-next v2 3/6] bpf: Reject a store through a fault prone pointer

On 8/15/26 12:40 AM, [email protected] wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 814096ed835d..cbbb0c82d22c 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -5788,7 +5788,7 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
>>   		return -EACCES;
>>   	}
>>
>> -	if (atype != BPF_READ && (type_flag(reg->type) & PTR_UNTRUSTED)) {
>> +	if (atype != BPF_READ && bpf_may_fault_on_deref(reg->type)) {
>>   		verbose(env, "only read is supported\n");
>>   		return -EACCES;
>>   	}
> 
> Does this change also reject HID-BPF writes to struct hid_device fields?
> 
> The HID struct_ops hid_bpf_ops_btf_struct_access() whitelists writes to
> hid_device::name, ::uniq, and ::phys via WRITE_RANGE entries in
> drivers/hid/bpf/hid_bpf_struct_ops.c. A HID program receives a
> 'struct hid_bpf_ctx *' argument that is PTR_TO_BTF_ID | PTR_TRUSTED, but
> walking hctx->hid produces a bare PTR_TO_BTF_ID because
> struct hid_bpf_ctx appears in no BTF_TYPE_SAFE_TRUSTED list in
> check_ptr_to_btf_access().
Hm, that doesn't seem right.. potentially sth like:

diff --git a/drivers/hid/bpf/hid_bpf_struct_ops.c b/drivers/hid/bpf/hid_bpf_struct_ops.c
index 702c22fae136..56c53aca4511 100644
--- a/drivers/hid/bpf/hid_bpf_struct_ops.c
+++ b/drivers/hid/bpf/hid_bpf_struct_ops.c
@@ -62,6 +62,10 @@ struct hid_bpf_offset_write_range {
         u32 end;
  };
  
+struct hid_bpf_ctx__safe_trusted {
+       struct hid_device *hid;
+};
+
  static int hid_bpf_ops_btf_struct_access(struct bpf_verifier_log *log,
                                            const struct bpf_reg_state *reg,
                                            int off, int size)
@@ -86,6 +90,8 @@ static int hid_bpf_ops_btf_struct_access(struct bpf_verifier_log *log,
         const char *cur = NULL;
         int i;
  
+       BTF_TYPE_EMIT(struct hid_bpf_ctx__safe_trusted);
+
         t = btf_type_by_id(reg->btf, reg->btf_id);
  
         for (i = 0; i < ARRAY_SIZE(write_ranges); i++) {