Re: [PATCH 1/2] bpf: Fix uninit read for non-fetch atomics on partially spilled slots

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Thu Sep 24, 2026 at 3:13 PM CEST, Hao Sun wrote:
> check_stack_read_fixed_off() skips partial spill checks for non-fetch
> atomics; the following prog can be loaded:
>
> 0: (b7) r1 = 1                        ; R1=1
> 1: (63) *(u32 *)(r10 -8) = r1         ; R1=1 R10=fp0 fp-8=????1
> 2: (db) lock *(u64 *)(r10 -8) += r1   ; R1=1 R10=fp0 fp-8=mmmmmmmm
> 3: (79) r0 = *(u64 *)(r10 -8)         ; R0=scalar() R10=fp0 fp-8=mmmmmmmm
> 4: (77) r0 >>= 32                     ; R0=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
> 5: (95) exit
>
> When test run:
> 	retval=4294967295
>
> Note fp-8 is ????1 at #1, yet it becomes fp-8=mmmmmmmm after the
> non-fetching atomic add at #2; hence the high 32 bits are leaked.
>
> Fix by applying the partial load check; after the patch, the
> prog is rejected:
>
> Verification failed: Memory Safety: Uninitialized stack read
>
> Reason:
>   This rejected read uses 8 bytes at stack offset -8, but byte 4 in that range is uninitialized on
>   this path. Programs loaded with CAP_PERFMON can be allowed to read uninitialized stack bytes, but
>   this program is being rejected without that allowance.
>
> At:
>   ...
>       0 | (b7) r1 = 1
>       1 | (63) *(u32 *)(r10 -8) = r1
>   >>> 2 | (db) lock *(u64 *)(r10 -8) += r1
>       3 | (79) r0 = *(u64 *)(r10 -8)
>       4 | (77) r0 >>= 32
>
> This affects CAP_BPF only.
>
> Fixes: 354e8f1970f8 ("bpf: Support <8-byte scalar spill and refill")
> Signed-off-by: Hao Sun <sunhao.th@gmail.com>
>
> ---

The same root cause is also reachable through check_stack_range_initialized().
It takes the spilled register path for every byte of a slot holding a spilled
scalar, without looking at the byte's own slot_type, so a helper or kfunc memory
argument spanning a narrow spill still reads the uninitialized half without
CAP_PERFMON:

  r1 = 1;
  *(u32 *)(r10 - 8) = r1;
  r1 = map_ringbuf ll;
  r2 = r10;
  r2 += -8;
  r3 = 8;
  r4 = 0;
  call bpf_ringbuf_output;

loads with CAP_BPF alone and copies four uninitialized bytes of kernel stack to
user space. The fix is to only take that path when *stype == STACK_SPILL, so the
rest of the slot goes through the usual MISC/ZERO/INVALID checks like any other
slot. Could you add that to v2 with a matching test (same Fixes: tag), since
it's the same bug on the helper path?

Locally I tried something like this and it addressed the problem.

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 200ec0f71617..9166dccef95a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7481,7 +7481,12 @@ static int check_stack_range_initialized(
                        goto mark;
                }

-               if (bpf_is_spilled_reg(ss) &&
+               /*
+                * Only the bytes marked STACK_SPILL hold the spilled register.
+                * The rest of a narrowly spilled slot keeps its previous type
+                * and must be initialized on its own.
+                */
+               if (*stype == STACK_SPILL &&
                    (ss->spilled_ptr.type == SCALAR_VALUE ||
                     env->allow_ptr_leaks)) {
                        if (clobber) {

Please also target bpf-next in next revision.

pw-bot: cr