From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F8FD32B9B5 for ; Mon, 13 Jul 2026 21:22:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783977752; cv=none; b=ge1vU2g/PAsL/AtLrh/v/Ed4mII8Jq1MAVJoWIkxCY0e2cUr6hXn8Yb7a9S43X63OBw4HvI53AtrifUO/eRWlTbqvuYXx5pwZXF9atK2Sz0cp9e2XW4XspnMf06xjjofsI4aeneSc72fcbQzhDt9rqezajPZ86AuRKFmsUCHmP4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783977752; c=relaxed/simple; bh=0911x5z746DSBGrJQdRd7PT2mgv7GWq115asLXG13ZU=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=VIX7B6PLemk2o/CQAFQ6UR3yVjATd93wE3yA8JiKT14WaXVWePIrDPFXHnerXE5ftPKWlkaNDqnImFO+m1b74LLRnhSDf6k5NT6DsgawZlXraHFfvaz+iLROelKQ+ovtnsW/L4e1C+eezoGZi23Kg90l7UcxCATE2BcyT1F0nag= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=rI53V3nQ; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="rI53V3nQ" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-84861fc51f5so2065171b3a.1 for ; Mon, 13 Jul 2026 14:22:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783977750; x=1784582550; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:from:to :cc:subject:date:message-id:reply-to:content-type; bh=012KWSmGKH9yQYdoYG3G0PrW1DobnL7zQ0ZLH/2ph6s=; b=rI53V3nQ2ig2TZ8WN48uvIgiYPv7S5jGO939hN+TXwG1MLYZ31CunGTLy6btueEakt GA4uPHOy3s3G/50KVDoXwXWvpMh2f64VRP+JKY6BXhmx6FGie8ltEddOUoZGBXwdQ9s1 nVsqkYBjUIfRIS9TLFz30pBsWvaXzkWGFQv1Bvy05o/hlb5ESnchyvHNuuUgiyQf5juB vJlWfr1aqDep5VlM7WQ8gWqM5r6a4ysdIf4iiqJLIvfVNbFCgNi3n2XKxB1AoQRX7HXV j/naa0Qj8rljz6EtIJxfwLplMa7OGcHXCiBIz7MN4LwS8aVK5hI7on8hYu4+87HeVghH Dp0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783977750; x=1784582550; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=012KWSmGKH9yQYdoYG3G0PrW1DobnL7zQ0ZLH/2ph6s=; b=Xb0FM4Mfbsr0jokaBZkFkNptCqVrsT3kO+1wtLPtYBeOnNiDSfu7vY8D6adV49HRNK Pp4t8S+25ljOGJmtO//XQytAeBWBGklWhLFyfEj8XLMbKuVdiVuRa5cxoM21iu9bZHIm Sz0GclN9koJWUA6L/scBGZImaHLkOpxcGLnEXY4NYe38TOxFpusqfBZzbPhw2nwXdzHW djAdTI9UEm4IQ9JRwNmkJs1Vn5WQMXy+g7cuiAk4o/0sPVpqnvmfy6KBQWtw6r7Ix1mo bTWo15YbyzXoaUPWdpDWPm45Oh3iOH/pM54rl1S4PIdElRqYrRKoxNYgkp39KEBTOMcD nQ8A== X-Forwarded-Encrypted: i=1; AHgh+Rqky2jIhVuiNUtKnNqPqJj+KKvAmVUbvUluFtdYyYAdIONvPfntV8mTuDCNIsC8KfZtyf4LHEprpPgpBzc=@vger.kernel.org X-Gm-Message-State: AOJu0YxCsHxIy4PAq3eOA9eJUsUehokPCoNhMyR/Kac8yinzaHk313Sv eXLlTm4tMV7ReKeUPPOOp9lxelqEQbGCNwC4wcZQwD3bFhH2mJC3jun3 X-Gm-Gg: AfdE7clJbSg9cfWVb0NCLySs+40nGSR5NZwBl/JT6zLG7lm1kEMJtqUlgB7/wxhSSqO +tuRT5m6d9tbgMNmbXGFRJiZ7vO2N4Ftu83fIIGkVsLU9x+KR5BU4w/FmArvAiTyFg21ZM056nJ myrRNWWHBL+wMrsq+d6gNfS+sFILI5O7EE3TsJ95RlQcZuvwpomX1g2Am0b7yjI/2QVpo+aUmNH vf6Vxouu/yGB5AjhT5X5Y8KE4+nqLD5m0HDRSKH6N/c4juTRRS+STJEAhUilpthqbq2sBZEBUly DiDOHUW1RV1oZwuUeAt3orqGy1lRm5G48CyWdeMHeZetGlp+Onc7a03896QR6aPSApnJJaaAhwd 6KcAdz+RZXamW7HiOcCzKU3/6DEefC67WxhLkjumzl3YuJ7X/uvZ+uYS11UiJIVivPqURD9GH2t R4XEY8qRdYk2xxL5RQ33uQOfIlUZqmOKz+cWtvYq+d X-Received: by 2002:a05:6a00:1954:b0:845:c373:6525 with SMTP id d2e1a72fcca58-8488975a5b1mr9606193b3a.41.1783977750383; Mon, 13 Jul 2026 14:22:30 -0700 (PDT) Received: from [192.168.0.13] ([38.34.87.7]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84a4f6bf016sm359029b3a.28.2026.07.13.14.22.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 14:22:30 -0700 (PDT) Message-ID: <77e5d785ca08a5fa57c661d9494f4551d0b55425.camel@gmail.com> Subject: Re: [PATCH bpf-next 1/2] bpf: Check byte type when validating helper stack reads From: Eduard Zingerman To: Yiyang Chen , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kumar Kartikeya Dwivedi Cc: John Fastabend , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Shuah Khan , bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Date: Mon, 13 Jul 2026 14:22:27 -0700 In-Reply-To: <855140e07cebafa6770d577ed107b2541b92f95e.1783920884.git.chenyy23@mails.tsinghua.edu.cn> References: <855140e07cebafa6770d577ed107b2541b92f95e.1783920884.git.chenyy23@mails.tsinghua.edu.cn> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.56.2-10 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Mon, 2026-07-13 at 06:16 +0000, Yiyang Chen wrote: > check_stack_range_initialized() validates helper ranges byte by byte, but > bpf_is_spilled_reg() only checks the slot-wide spill marker. For a CAP_BP= F > load, a narrow scalar spill marks only the covered bytes as STACK_SPILL. = An > untouched sibling remains STACK_INVALID, but the helper still accepts the > read when the slot contains a spilled scalar. >=20 > Require the byte being checked to be STACK_SPILL before accepting the > slot-wide scalar spill state. >=20 > Fixes: 354e8f1970f8 ("bpf: Support <8-byte scalar spill and refill") > Signed-off-by: Yiyang Chen > --- > =C2=A0kernel/bpf/verifier.c | 3 ++- > =C2=A01 file changed, 2 insertions(+), 1 deletion(-) >=20 > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index 03e2202cca13d..c971cf34c760b 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -6785,7 +6785,8 @@ static int check_stack_range_initialized( > =C2=A0 goto mark; > =C2=A0 } > =C2=A0 > - if (bpf_is_spilled_reg(&state->stack[spi]) && > + if (*stype =3D=3D STACK_SPILL && > + =C2=A0=C2=A0=C2=A0 bpf_is_spilled_reg(&state->stack[spi]) && Sorry, could you please explain again what's wrong with the original check? Here it is: if (bpf_is_spilled_reg(&state->stack[spi]) && (state->stack[spi].spilled_ptr.type =3D=3D SCALAR_VALUE= || env->allow_ptr_leaks)) { ... accepted ... } And it says: if there is a register spill at 'spi': - always allow access if the spilled register is scalar - when allow_ptr_leaks is true, allow access when spilled register is either scalar or pointer. The goal here is to avoid leaking pointers, and pointers are always 8-bytes= . > =C2=A0 =C2=A0=C2=A0=C2=A0 (state->stack[spi].spilled_ptr.type =3D=3D SCA= LAR_VALUE || > =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 env->allow_ptr_leaks)) { > =C2=A0 if (clobber) { pw-bot: cr.