The verifier checks helper memory arguments byte by byte, but its scalar spill fast path only checks the slot-wide spill marker. For a CAP_BPF load, a narrow scalar spill can therefore make an untouched sibling byte appear initialized when the sibling is passed to a helper.
Patch 1 makes the fast path require STACK_SPILL for the byte being checked. Patch 2 adds verifier_spill_fill coverage for a CAP_BPF map update helper reading an invalid sibling byte. Yiyang Chen (2): bpf: Check byte type when validating helper stack reads selftests/bpf: Cover helper reads of invalid spill siblings kernel/bpf/verifier.c | 3 +- .../selftests/bpf/progs/verifier_spill_fill.c | 33 +++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) base-commit: 9a3a07d06e7d74f4aecc51396c771149336ac55d -- 2.34.1
