Commit 06050851 authored by Tao Lyu's avatar Tao Lyu Committed by Chen Zhongjin
Browse files

bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots 

mainline inclusion
from mainline-v6.13-rc2
commit b0e66977dc072906bb76555fb1a64261d7f63d0f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBFYC8

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b0e66977dc072906bb76555fb1a64261d7f63d0f

--------------------------------

When CAP_PERFMON and CAP_SYS_ADMIN (allow_ptr_leaks) are disabled, the
verifier aims to reject partial overwrite on an 8-byte stack slot that
contains a spilled pointer.

However, in such a scenario, it rejects all partial stack overwrites as
long as the targeted stack slot is a spilled register, because it does
not check if the stack slot is a spilled pointer.

Incomplete checks will result in the rejection of valid programs, which
spill narrower scalar values onto scalar slots, as shown below.

0: R1=ctx() R10=fp0
; asm volatile ( @ repro.bpf.c:679
0: (7a) *(u64 *)(r10 -8) = 1          ; R10=fp0 fp-8_w=1
1: (62) *(u32 *)(r10 -8) = 1
attempt to corrupt spilled pointer on stack
processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0.

Fix this by expanding the check to not consider spilled scalar registers
when rejecting the write into the stack.

Previous discussion on this patch is at link [0].

  [0]: https://lore.kernel.org/bpf/20240403202409.2615469-1-tao.lyu@epfl.ch



Fixes: ab125ed3ec1c ("bpf: fix check for attempt to corrupt spilled pointer")
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarTao Lyu <tao.lyu@epfl.ch>
Signed-off-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241204044757.1483141-3-memxor@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarChen Zhongjin <chenzhongjin@huawei.com>
parent ebae66c4

kernel/bpf/verifier.c

+1 −0
Original line number Diff line number Diff line
@@ -2681,6 +2681,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, 
	 */

	if (!env->allow_ptr_leaks &&

	    is_spilled_reg(&state->stack[spi]) &&

	    !is_spilled_scalar_reg(&state->stack[spi]) &&

	    size != BPF_REG_SIZE) {

		verbose(env, "attempt to corrupt spilled pointer on stack\n");

		return -EACCES;