Commit 31ff2135 authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Alexei Starovoitov
Browse files

bpf: BPF_ST with variable offset should preserve STACK_ZERO marks 



BPF_STX instruction preserves STACK_ZERO marks for variable offset
writes in situations like below:

  *(u64*)(r10 - 8) = 0   ; STACK_ZERO marks for fp[-8]
  r0 = random(-7, -1)    ; some random number in range of [-7, -1]
  r0 += r10              ; r0 is now a variable offset pointer to stack
  r1 = 0
  *(u8*)(r0) = r1        ; BPF_STX writing zero, STACK_ZERO mark for
                         ; fp[-8] is preserved

This commit updates verifier.c:check_stack_write_var_off() to process
BPF_ST in a similar manner, e.g. the following example:

  *(u64*)(r10 - 8) = 0   ; STACK_ZERO marks for fp[-8]
  r0 = random(-7, -1)    ; some random number in range of [-7, -1]
  r0 += r10              ; r0 is now variable offset pointer to stack
  *(u8*)(r0) = 0         ; BPF_ST writing zero, STACK_ZERO mark for
                         ; fp[-8] is preserved

Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20230214232030.1502829-4-eddyz87@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 1a24af65

kernel/bpf/verifier.c

+3 −1
Original line number Diff line number Diff line
@@ -3631,6 +3631,7 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env, 
	int min_off, max_off;

	int i, err;

	struct bpf_reg_state *ptr_reg = NULL, *value_reg = NULL;

	struct bpf_insn *insn = &env->prog->insnsi[insn_idx];

	bool writing_zero = false;

	/* set if the fact that we're writing a zero is used to let any

	 * stack slots remain STACK_ZERO
@@ -3643,7 +3644,8 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env, 
	max_off = ptr_reg->smax_value + off + size;

	if (value_regno >= 0)

		value_reg = &cur->regs[value_regno];

	if (value_reg && register_is_null(value_reg))

	if ((value_reg && register_is_null(value_reg)) ||

	    (!value_reg && is_bpf_st_mem(insn) && insn->imm == 0))

		writing_zero = true;









	err = grow_stack_state(state, round_up(-min_off, BPF_REG_SIZE));