This fixes the verifier_bug_if() that runs on nospec_result to not trigger for BPF_CALL (bug reported by Hu, Mei, and Mu). See patch 1 for a full description and patch 2 for a test (based on the PoC from the report).
While working on this I noticed two other problems: - nospec_result is currently ignored for BPF_CALL during patching, but it may be required if we assume the CPU may speculate into/out of functions. - Both the instruction patching for nospec and nospec_result erases the instruction aux information even thought it might be better to keep that. For nospec_result it may be fine as it is only applied to store instructions currently (except for when we decide to change the thing from above), but nospec may be set for arbitrary instructions and if these require rewrites they break. I assume these issues are better fixed separately, thus I decided to exclude them from this series. Luis Gerhorst (2): bpf: Fix verifier_bug_if to account for BPF_CALL bpf: Test nospec after dead stack write in helper kernel/bpf/verifier.c | 14 +++++++----- .../selftests/bpf/progs/verifier_unpriv.c | 22 +++++++++++++++++++ 2 files changed, 30 insertions(+), 6 deletions(-) base-commit: 8016abd6314ed1ed01ff09404e3c82ceb13c185b -- 2.52.0
