For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] bpf: reject non-scalar R1 for bpf_loop() helper
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master

syzbot reported a verifier backtracking warning ("backtracking misuse")
in bpf_mark_chain_precision() triggered by a crafted program that calls
bpf_loop() with a non-scalar value in R1 (nr_loops).

bpf_loop()'s prototype declares arg1_type as ARG_ANYTHING, which accepts
any initialized register, including pointers. However, check_helper_call()
unconditionally calls mark_chain_precision() on R1, because the verifier
relies on the nr_loops value to reason about loop termination. Precision
tracking is only valid for SCALAR_VALUE registers, so passing a pointer in
R1 reaches the SCALAR_VALUE assertion in the backtracking code and trips
the warning instead of failing verification cleanly.

Reject the program with a proper error when R1 is not a scalar, before
calling mark_chain_precision().

Reported-by: syzbot+7b47f87674e9a1569110@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7b47f87674e9a1569110
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 kernel/bpf/verifier.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e421ea2b80c3..d8df29ac7dac 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10886,6 +10886,10 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 		break;
 	case BPF_FUNC_loop:
 		update_loop_inline_state(env, meta.subprogno);
+		if (cur_regs(env)[BPF_REG_1].type != SCALAR_VALUE) {
+			verbose(env, "R1 must be a scalar for bpf_loop\n");
+			return -EINVAL;
+		}
 		/* Verifier relies on R1 value to determine if bpf_loop() iteration
 		 * is finished, thus mark it precise.
 		 */
-- 
2.34.1