[PATCH bpf-next 1/2] bpf: Check byte type when validating helper stack reads

[Yiyang Chen]

check_stack_range_initialized() validates helper ranges byte by byte, but
bpf_is_spilled_reg() only checks the slot-wide spill marker. For a CAP_BPF
load, a narrow scalar spill marks only the covered bytes as STACK_SPILL. An
untouched sibling remains STACK_INVALID, but the helper still accepts the
read when the slot contains a spilled scalar.

Require the byte being checked to be STACK_SPILL before accepting the
slot-wide scalar spill state.

Fixes: 354e8f1970f8 ("bpf: Support <8-byte scalar spill and refill")
Signed-off-by: Yiyang Chen <cheny...@mails.tsinghua.edu.cn>
---
 kernel/bpf/verifier.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 03e2202cca13d..c971cf34c760b 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6785,7 +6785,8 @@ static int check_stack_range_initialized(
                        goto mark;
                }
 
-               if (bpf_is_spilled_reg(&state->stack[spi]) &&
+               if (*stype == STACK_SPILL &&
+                   bpf_is_spilled_reg(&state->stack[spi]) &&
                    (state->stack[spi].spilled_ptr.type == SCALAR_VALUE ||
                     env->allow_ptr_leaks)) {
                        if (clobber) {
-- 
2.34.1