diff options
| author | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2026-09-21 04:38:28 +0200 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-09-21 17:12:39 +0000 |
| commit | fc670d4b6c31d69f5e872a397d17fe4c5f970ffe (patch) | |
| tree | aac92580b9d1a476281c2e4aaac6588af979b1be /include/linux | |
| parent | fc8dc2be101b038adf6c36c51511a53ca2407199 (diff) | |
| download | linux-next-fc670d4b6c31d69f5e872a397d17fe4c5f970ffe.tar.gz linux-next-fc670d4b6c31d69f5e872a397d17fe4c5f970ffe.zip | |
bpf: Fix generic __uninit kfunc output buffers
Stack liveness treats __uninit kfunc arguments as writes. Even with
write-only access checks, ordinary clobber handling leaves poisoned stack
bytes poisoned after the call, so the output cannot be read.
Reuse the helper output descriptor for generic kfunc buffers. Record the
output after resolving its memory type, and initialize its stack bytes
only after all arguments have been checked. This prevents an output from
making an aliased, uninitialized input appear valid.
Track the output by its ABI argument slot, since a kfunc pointer may be
passed on the stack or follow a multi-slot by-value argument. Keep the
single-output restriction in prototype validation; multiple-output
tracking is a separate extension.
Document that output buffers must be fully initialized on every return
path, including error returns and padding.
Fixes: 2cb27158adb3 ("bpf: poison dead stack slots")
Reported-by: Tejun Heo <tj@kernel.org>
Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/86d966ec88bbf27d21b2bb4e18c8aa00@kernel.org
Link: https://patch.msgid.link/20260921023843.411943-5-memxor@gmail.com
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/bpf_verifier.h | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index cf85141ea167..6ff1c227d298 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -1548,10 +1548,11 @@ struct ref_obj_desc { /* * A memory argument a call fills in. The verifier allows the stack to be uninitialized if - * the range is a known constant. Stack slots are marked as STACK_MISC by check_mem_access(). + * the range is a known constant. Stack slots are marked as STACK_MISC by check_mem_access() + * after all arguments have been checked. */ struct arg_raw_mem_desc { - u8 regno; + u8 argno; /* One-based ABI argument slot; zero means no output. */ int size; }; @@ -1579,6 +1580,7 @@ struct bpf_call_arg_meta { struct bpf_dynptr_desc dynptr; struct ref_obj_desc ref_obj; struct ret_mem_desc ret_mem; + struct arg_raw_mem_desc arg_raw_mem; /* Only set by kfunc */ bool r0_rdonly; @@ -1617,7 +1619,6 @@ struct bpf_call_arg_meta { s64 const_map_key; struct btf *ret_btf; struct btf_field *kptr_field; - struct arg_raw_mem_desc arg_raw_mem; }; int bpf_get_helper_proto(struct bpf_verifier_env *env, int func_id, |