On Mon, Dec 2, 2024 at 12:38 AM Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx> wrote: > > From: Tao Lyu <tao.lyu@xxxxxxx> > > When CAP_PERFMON and CAP_SYS_ADMIN (allow_ptr_leaks) are disabled, the > verifier aims to reject partial overwrite on an 8-byte stack slot that > contains a spilled pointer. > > However, in such a scenario, it rejects all partial stack overwrites as > long as the targeted stack slot is a spilled register, because it does > not check if the stack slot is a spilled pointer. > > Incomplete checks will result in the rejection of valid programs, which > spill narrower scalar values onto scalar slots, as shown below. > > 0: R1=ctx() R10=fp0 > ; asm volatile ( @ repro.bpf.c:679 > 0: (7a) *(u64 *)(r10 -8) = 1 ; R10=fp0 fp-8_w=1 > 1: (62) *(u32 *)(r10 -8) = 1 > attempt to corrupt spilled pointer on stack > processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0. > > Fix this by expanding the check to not consider spilled scalar registers > when rejecting the write into the stack. > > Previous discussion on this patch is at link [0]. > > [0]: https://lore.kernel.org/bpf/20240403202409.2615469-1-tao.lyu@xxxxxxx > > Fixes: ab125ed3ec1c ("bpf: fix check for attempt to corrupt spilled pointer") > Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx> > Signed-off-by: Tao Lyu <tao.lyu@xxxxxxx> > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx> > --- > kernel/bpf/verifier.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index c6a5c431495c..51f7a846d719 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -4703,6 +4703,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, > */ > if (!env->allow_ptr_leaks && > is_spilled_reg(&state->stack[spi]) && > + !is_spilled_scalar_reg(&state->stack[spi]) && Makes sense: Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx> > size != BPF_REG_SIZE) { > verbose(env, "attempt to corrupt spilled pointer on stack\n"); > return -EACCES; > -- > 2.43.5 >
