In the Linux kernel, the following vulnerability has been resolved:
bpf: Don't infer non-NULL from a pointer with an unbounded offset
reg_not_null() decides that a register holds a non-NULL value by
looking at its type alone. For pointer types that allow arithmetic the
type only guarantees a non-NULL base, in case of an unbound offset
the runtime offset value might still add up to NULL.
Consider the followng program:
r6 = bpf_map_lookup_elem(map, &0); / present /
if (r6 == 0) return 0;
r7 = bpf_map_lookup_elem(map, &1); / absent, NULL at runtime /
r8 = r7;
r8 -= r6; / pointer - pointer: unknown scalar, -r6 /
r8 <<= 1;
r8 >>= 1; / any non-negative offset is accepted by /
/ check_reg_sane_offset_ptr() /
r6 += r8; / verifier: map value; runtime: zero /
if (r7 != r6) return 0;
(u8 )(r7 + 0); / r7 is inferred non-NULL, both are zero /
At runtime both registers are zero, the comparison is true and the
load faults with NULL pointer dereference.
Require the offset to be within +-BPF_MAX_VAR_OFF in reg_not_null().