From nobody Sat Jul 25 02:11:16 2026 Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [4.193.249.245]) by smtp.subspace.kernel.org (Postfix) with ESMTP id ACD233C454E; Mon, 20 Jul 2026 16:43:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=4.193.249.245 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784565792; cv=none; b=qP+0OVgOnDeJCpM7APyQYCx10Ls29xOy2BqNcPC14yTItQkKA+x8oxmKRefCF6Gx2q7LdqM/Rf5MGQ1lo5CEPyLMDd/lfFwaX9/oPRP9NPRBhAqqQ8uS9fFeEwZWQG7giTNHb2qGSZ/I2Oy6GW2t1Fjx2G8HKmhmShawmaHmTig= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784565792; c=relaxed/simple; bh=Pf9FKFiD+3sCvJQkhMXUXOFjABalyHpc5Z6NhqtEixQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Rgv+54KSG+H0fj8t0AE6+doGU0OP3I+D3SuO0gdKyaZqUYvu/6nOUirF1F0TW51oWFuec913E4dzyG/HtSr28yAfcHo2kwf9WwyW8N/4pvSYqUlbAxpMz59hZ3sMaVofqag6ks5cnlwI3ptpP0ev5tbCtMwrVBgdIRJPa9bFrcs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mails.tsinghua.edu.cn; spf=pass smtp.mailfrom=mails.tsinghua.edu.cn; dkim=pass (1024-bit key) header.d=mails.tsinghua.edu.cn header.i=@mails.tsinghua.edu.cn header.b=KOTgRVBh; arc=none smtp.client-ip=4.193.249.245 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mails.tsinghua.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mails.tsinghua.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mails.tsinghua.edu.cn header.i=@mails.tsinghua.edu.cn header.b="KOTgRVBh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mails.tsinghua.edu.cn; s=dkim; h=Received:From:To:Cc:Subject: Date:Message-Id:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=BV3iMZqr+wyDnIuGY0yLA7i+Yxkbu7DsXn 7fEjaWcPw=; b=KOTgRVBhduD+2w3iRv6vOs8bekz3kND/4cKzQCmn78LM/zsUWF f83xSnrZIm2J+3TlcSpeJak5a2Jeoi0jk+FvtbJO6kQjj05qYLqxN6Sa55p7J5dm EZRLkY5iSKf+2n7CELaual0L8cMhygNu/Ct9AbMK5dYPy4Asdyofo7Rs0= Received: from c9a6c405b3f2.. (unknown [202.112.238.121]) by web2 (Coremail) with SMTP id yQQGZQDX1bcGUF5q2kYhAA--.51004S3; Tue, 21 Jul 2026 00:42:52 +0800 (CST) From: Yiyang Chen To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi Cc: Yiyang Chen , John Fastabend , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Shuah Khan , Emil Tsalapatis , bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next 1/2] bpf: Preserve stack frame number for commuted arithmetic Date: Mon, 20 Jul 2026 16:37:44 +0000 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: yQQGZQDX1bcGUF5q2kYhAA--.51004S3 X-Coremail-Antispam: 1UD129KBjvJXoW7Kr1xWw1xtw43Jr18CF4kJFb_yoW8Ar13pr Z3K3s3tw4kKa429wnFvFn7AFZ0kan7J34fCr1UA34Iy3WDJ34YqrWrKFy5JFWSkF4kJa40 vr1j93yav3Z8Z3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQK14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jr4l82xGYIkIc2 x26xkF7I0E14v26r4j6ryUM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84 ACjcxK6I8E87Iv67AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UM2vY z4IE04k24VAvwVAKI4IrM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c 02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE 4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7M4 IIrI8v6xkF7I0E8cxan2IY04v7MxkF7I0En4kS14v26r1q6r43MxkIecxEwVAFwVWUMxAI w28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr 4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVW8ZVWrXwCIc40Y0x0EwIxG rwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJw CI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2 z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7sREyv33UUUUU== X-CM-SenderInfo: xfkh05r1stqzpdlo2hxwvl0wxkxdhvlgxou0/ Content-Type: text/plain; charset="utf-8" When scalar +=3D pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer type and id from the source pointer. For PTR_TO_STACK, the inherited pointer state also has to carry the stack frame number. Without the frame number copy, a stack pointer derived inside a callee through scalar +=3D fp can be recorded as pointing to frame 0. Stack reads and writes through that register can then update or consult the caller frame while the actual instruction uses the callee frame. Copy the frame number when PTR_TO_STACK state is inherited by the commuted arithmetic form. Signed-off-by: Yiyang Chen --- kernel/bpf/verifier.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 52be0a118cce0..58017141d52b7 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -13796,11 +13796,14 @@ static int adjust_ptr_min_max_vals(struct bpf_ver= ifier_env *env, return -EACCES; } =20 - /* In case of 'scalar +=3D pointer', dst_reg inherits pointer type and id. - * The id may be overwritten later if we create a new variable offset. + /* In case of 'scalar +=3D pointer', dst_reg inherits pointer type, id, + * and for stack pointers also the frame number. The id may be overwritten + * later if we create a new variable offset. */ dst_reg->type =3D ptr_reg->type; dst_reg->id =3D ptr_reg->id; + if (base_type(ptr_reg->type) =3D=3D PTR_TO_STACK) + dst_reg->frameno =3D ptr_reg->frameno; =20 if (!check_reg_sane_offset_scalar(env, off_reg, ptr_reg->type) || !check_reg_sane_offset_ptr(env, ptr_reg, ptr_reg->type)) --=20 2.34.1 From nobody Sat Jul 25 02:11:16 2026 Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [13.75.44.102]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D14B743E071; Mon, 20 Jul 2026 16:43:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.75.44.102 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784565792; cv=none; b=aWO8aW3oN3PDRjAe9FYzeaVPJd2h9AuJkur2QxTzrFKAPUHwwTbuz1BTNvSwkZUfJ98A/4cXn/I7yjgzy8k90LI9gz4TTdk5q44f/2ZmmHypdI5raNj+INpkckKSr42SHCRG6olzAs38CiCuBcSIdpD7AFnfMPM4x4ozZDB9Lns= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784565792; c=relaxed/simple; bh=UWnniLm65KaS5SRJI4XMphEP4Hx1T+PlqV6EOZTR7FE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=SVasQoKU/gST3XOE9HVX67PAAbzrAXwgVsVcvzcFHWo3p5fhiKetR3oAHJLhJpnCFx7io3lODD1Qr0Pvl83s1dRzq+5N7SNkIGsRVxVj1M/b53FnkAT0awfVCi3QLFdh6u1+MMTXapVwPxt0U0wR9wZB/CwSKbQyOUPXOwPwMhI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mails.tsinghua.edu.cn; spf=pass smtp.mailfrom=mails.tsinghua.edu.cn; dkim=pass (1024-bit key) header.d=mails.tsinghua.edu.cn header.i=@mails.tsinghua.edu.cn header.b=c5aPwSVe; arc=none smtp.client-ip=13.75.44.102 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mails.tsinghua.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mails.tsinghua.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mails.tsinghua.edu.cn header.i=@mails.tsinghua.edu.cn header.b="c5aPwSVe" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mails.tsinghua.edu.cn; s=dkim; h=Received:From:To:Cc:Subject: Date:Message-Id:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=vDCpJ1bWGK3VjI9ZcwfOWFxt+A0+AHkkyD r3H/6ccsk=; b=c5aPwSVez563QkIK3MZdEfB/Z6GnV754HOxOnibZ09CBKzHRDe ZMBnawIob3CtK977tWkBsBeHW9sxTG157rlRoWthqmFpM2OCphs8qAbaDBT5l1y7 lcvKIFOj1DpIOJ7fwrxGAZwNZEKPP/yFfN4iHLR5xdltQLwk4pSxMdIpg= Received: from c9a6c405b3f2.. (unknown [202.112.238.121]) by web2 (Coremail) with SMTP id yQQGZQDX1bcGUF5q2kYhAA--.51004S4; Tue, 21 Jul 2026 00:42:54 +0800 (CST) From: Yiyang Chen To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi Cc: Yiyang Chen , John Fastabend , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Shuah Khan , Emil Tsalapatis , bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next 2/2] selftests/bpf: Cover stack frame number after scalar plus fp Date: Mon, 20 Jul 2026 16:37:45 +0000 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: yQQGZQDX1bcGUF5q2kYhAA--.51004S4 X-Coremail-Antispam: 1UD129KBjvJXoWxGw17Xw18tw18WFW3Jr4fKrg_yoWruryxpa 4kuF9IqFn7Arn2gF17CF129FyrCF4qv345Xr40vr13ZF18Jr1DXrZ2gFy5Jrn3GaykZw1Y v342qasxAa1UJ3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQE14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jryl82xGYIkIc2 x26xkF7I0E14v26ryj6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UM2 8EF7xvwVC2z280aVAFwI0_Gr0_Cr1l84ACjcxK6I8E87Iv6xkF7I0E14v26r4j6r4UJwAa c4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzV Aqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S 6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxw ACI402YVCY1x02628vn2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCY02Avz4vE14v_JwCF 04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r 18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_GFv_WrylIxkGc2Ij64vI r41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr 1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvE x4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JU88nrUUUUU= X-CM-SenderInfo: xfkh05r1stqzpdlo2hxwvl0wxkxdhvlgxou0/ Content-Type: text/plain; charset="utf-8" Add a verifier test where a callee spills a map value pointer. It then derives its frame pointer through scalar +=3D fp. It overwrites the same stack slot through the derived pointer. The final reload must be treated as a scalar after the overwrite. The verifier should reject the program when the reloaded value is dereferenced. Signed-off-by: Yiyang Chen --- .../selftests/bpf/prog_tests/verifier.c | 2 - .../bpf/prog_tests/verifier_basic_stack.c | 28 +++++++++++++ .../bpf/progs/verifier_basic_stack.c | 41 +++++++++++++++++++ 3 files changed, 69 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/verifier_basic_s= tack.c diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/test= ing/selftests/bpf/prog_tests/verifier.c index be97f6887f0e7..0483ae340726c 100644 --- a/tools/testing/selftests/bpf/prog_tests/verifier.c +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c @@ -11,7 +11,6 @@ #include "verifier_arena_globals2.skel.h" #include "verifier_array_access.skel.h" #include "verifier_async_cb_context.skel.h" -#include "verifier_basic_stack.skel.h" #include "verifier_bitfield_write.skel.h" #include "verifier_bounds.skel.h" #include "verifier_bounds_deduction.skel.h" @@ -165,7 +164,6 @@ void test_verifier_arena(void) { RUN(ver= ifier_arena); } void test_verifier_arena_large(void) { RUN(verifier_arena_large);= } void test_verifier_arena_globals1(void) { RUN(verifier_arena_globals= 1); } void test_verifier_arena_globals2(void) { RUN(verifier_arena_globals= 2); } -void test_verifier_basic_stack(void) { RUN(verifier_basic_stack);= } void test_verifier_bitfield_write(void) { RUN(verifier_bitfield_writ= e); } void test_verifier_bounds(void) { RUN(verifier_bounds); } void test_verifier_bounds_deduction(void) { RUN(verifier_bounds_deduct= ion); } diff --git a/tools/testing/selftests/bpf/prog_tests/verifier_basic_stack.c = b/tools/testing/selftests/bpf/prog_tests/verifier_basic_stack.c new file mode 100644 index 0000000000000..279f389729b8e --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/verifier_basic_stack.c @@ -0,0 +1,28 @@ +// SPDX-License-Identifier: GPL-2.0-only + +#include + +#include "cap_helpers.h" +#include "verifier_basic_stack.skel.h" + +void test_verifier_basic_stack(void) +{ + struct test_loader tester =3D {}; + __u64 old_caps; + int err; + + /* test_verifier tests are executed w/o CAP_SYS_ADMIN, do the same here */ + err =3D cap_disable_effective(1ULL << CAP_SYS_ADMIN, &old_caps); + if (err) { + PRINT_FAIL("failed to drop CAP_SYS_ADMIN: %i, %s\n", err, strerror(-err)= ); + return; + } + + test_loader__run_subtests(&tester, "verifier_basic_stack", + verifier_basic_stack__elf_bytes); + test_loader_fini(&tester); + + err =3D cap_enable_effective(old_caps, NULL); + if (err) + PRINT_FAIL("failed to restore CAP_SYS_ADMIN: %i, %s\n", err, strerror(-e= rr)); +} diff --git a/tools/testing/selftests/bpf/progs/verifier_basic_stack.c b/too= ls/testing/selftests/bpf/progs/verifier_basic_stack.c index fb62e09f21146..634183fc86883 100644 --- a/tools/testing/selftests/bpf/progs/verifier_basic_stack.c +++ b/tools/testing/selftests/bpf/progs/verifier_basic_stack.c @@ -97,4 +97,45 @@ __naked void misaligned_read_from_stack(void) " ::: __clobber_all); } =20 +SEC("socket") +__description("stack pointer arithmetic preserves frame number") +__failure __msg("R7 invalid mem access 'scalar'") +__naked void stack_ptr_arith_preserves_frameno(void) +{ + asm volatile (" \ + r3 =3D 0; \ + *(u64 *)(r10 - 8) =3D r3; \ + r1 =3D %[map_hash_8b] ll; \ + r2 =3D r10; \ + r2 +=3D -8; \ + call %[bpf_map_lookup_elem]; \ + if r0 !=3D 0 goto +2; \ + r0 =3D 0; \ + exit; \ + r1 =3D r0; \ + r2 =3D 0; \ + r3 =3D 0; \ + call stack_ptr_arith_preserves_frameno_subprog; \ + r0 =3D 0; \ + exit; \ +" : + : __imm(bpf_map_lookup_elem), + __imm_addr(map_hash_8b) + : __clobber_all); +} + +static __used __naked void stack_ptr_arith_preserves_frameno_subprog(void) +{ + asm volatile (" \ + *(u64 *)(r10 - 8) =3D r1; \ + r6 =3D -8; \ + r6 +=3D r10; \ + *(u64 *)(r6 + 0) =3D r2; \ + r7 =3D *(u64 *)(r10 - 8); \ + *(u64 *)(r7 + 0) =3D r3; \ + r0 =3D 0; \ + exit; \ +" ::: __clobber_all); +} + char _license[] SEC("license") =3D "GPL"; --=20 2.34.1