The verifier checks helper memory arguments byte by byte, but its scalar spill fast path only checks the slot-wide spill marker. For a CAP_BPF load, a narrow scalar spill can therefore make an untouched sibling byte appear initialized when the sibling is passed to a helper.
Patch 1 makes the fast path require STACK_SPILL for the byte being checked. Patch 2 adds verifier_spill_fill coverage for a CAP_BPF map update helper reading an invalid sibling byte. Changes in v2: - Rewrite the patch 1 commit message to explain the uninitialized-stack-read invariant and distinguish it from the pointer-leak check, with references to the related producer-side fix and direct-read selftest. - Add the regression Fixes tag to patch 2 and use the neighboring inline-asm line-continuation style. v1: https://lore.kernel.org/bpf/[email protected]/ Yiyang Chen (2): bpf: Check byte type when validating helper stack reads selftests/bpf: Cover helper reads of invalid spill siblings kernel/bpf/verifier.c | 3 +- .../selftests/bpf/progs/verifier_spill_fill.c | 34 +++++++++++++++++++ 2 files changed, 36 insertions(+), 1 deletion(-) base-commit: 1d91ea01185656ac3ee63c5f9f6f8bde3c746b3d -- 2.34.1
