Patch "bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-don-t-mark-stack_invalid-as-stack_misc-in-mark_s.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3414a25eb060a525af721a6389b42ebd51d567df
Author: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
Date:   Tue Dec 3 20:47:53 2024 -0800

    bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
    
    [ Upstream commit 69772f509e084ec6bca12dbcdeeeff41b0103774 ]
    
    Inside mark_stack_slot_misc, we should not upgrade STACK_INVALID to
    STACK_MISC when allow_ptr_leaks is false, since invalid contents
    shouldn't be read unless the program has the relevant capabilities.
    The relaxation only makes sense when env->allow_ptr_leaks is true.
    
    However, such conversion in privileged mode becomes unnecessary, as
    invalid slots can be read without being upgraded to STACK_MISC.
    
    Currently, the condition is inverted (i.e. checking for true instead of
    false), simply remove it to restore correct behavior.
    
    Fixes: eaf18febd6eb ("bpf: preserve STACK_ZERO slots on partial reg spills")
    Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Reported-by: Tao Lyu <tao.lyu@xxxxxxx>
    Signed-off-by: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20241204044757.1483141-2-memxor@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8955259112c03..cdf8ce1e2cc4f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1200,14 +1200,17 @@ static bool is_spilled_scalar_reg64(const struct bpf_stack_state *stack)
 /* Mark stack slot as STACK_MISC, unless it is already STACK_INVALID, in which
  * case they are equivalent, or it's STACK_ZERO, in which case we preserve
  * more precise STACK_ZERO.
- * Note, in uprivileged mode leaving STACK_INVALID is wrong, so we take
- * env->allow_ptr_leaks into account and force STACK_MISC, if necessary.
+ * Regardless of allow_ptr_leaks setting (i.e., privileged or unprivileged
+ * mode), we won't promote STACK_INVALID to STACK_MISC. In privileged case it is
+ * unnecessary as both are considered equivalent when loading data and pruning,
+ * in case of unprivileged mode it will be incorrect to allow reads of invalid
+ * slots.
  */
 static void mark_stack_slot_misc(struct bpf_verifier_env *env, u8 *stype)
 {
 	if (*stype == STACK_ZERO)
 		return;
-	if (env->allow_ptr_leaks && *stype == STACK_INVALID)
+	if (*stype == STACK_INVALID)
 		return;
 	*stype = STACK_MISC;
 }