[v1] bpf: Validate byte type for helper stack reads

[PATCH bpf-next 0/2] bpf: Validate byte type for helper stack reads

Yiyang Chen posted 2 patches 1 week, 5 days ago

Diff against v2
Download series mbox

There is a newer version of this series

kernel/bpf/verifier.c                         |  3 +-
.../selftests/bpf/progs/verifier_spill_fill.c | 33 +++++++++++++++++++
2 files changed, 35 insertions(+), 1 deletion(-)

Expand all Fold all

[PATCH bpf-next 0/2] bpf: Validate byte type for helper stack reads

Posted by Yiyang Chen 1 week, 5 days ago

The verifier checks helper memory arguments byte by byte, but its scalar
spill fast path only checks the slot-wide spill marker. For a CAP_BPF load,
a narrow scalar spill can therefore make an untouched sibling byte appear
initialized when the sibling is passed to a helper.

Patch 1 makes the fast path require STACK_SPILL for the byte being checked.
Patch 2 adds verifier_spill_fill coverage for a CAP_BPF map update helper
reading an invalid sibling byte.

Yiyang Chen (2):
  bpf: Check byte type when validating helper stack reads
  selftests/bpf: Cover helper reads of invalid spill siblings

 kernel/bpf/verifier.c                         |  3 +-
 .../selftests/bpf/progs/verifier_spill_fill.c | 33 +++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)


base-commit: 9a3a07d06e7d74f4aecc51396c771149336ac55d
-- 
2.34.1