check_stack_arg_read() bounds a stack argument index with the callee's
BTF-derived argument count, then uses the index in the caller's
stack_arg_regs[] array. The array's actual logical length is recorded in
caller->out_stack_arg_cnt, so the bound and indexed object can diverge. A
crafted BPF_PROG_LOAD can use an argument mismatch to mark a static
subprogram's BTF information unreliable. Later calls return from
btf_check_subprog_call() before check_outgoing_stack_args(), while
check_func_call() continues the static call on -EINVAL. The callee can
then read a slot that the caller never allocated or initialized. Async
callback verification also starts at curframe zero, so subtracting one
to find a caller can underflow the frame array.
On x86-64, KASAN reports the resulting out-of-bounds copy as:
BUG: KASAN: slab-out-of-bounds in check_load_mem+0xb51/0xc60
Read of size 80 at addr ffff8881009af550 by task poc/131
Call Trace:
check_stack_arg_read at kernel/bpf/verifier.c:4234
(inlined by) check_load_mem at kernel/bpf/verifier.c:6645
do_check_common at kernel/bpf/verifier.c:19568
bpf_check at kernel/bpf/verifier.c:21318
bpf_prog_load at kernel/bpf/syscall.c:3134
The copy replaces the destination with a complete struct bpf_reg_state.
A deterministic reproducer retained a PTR_TO_MAP_VALUE state in
allocation slack, imported it into R0 through this read, and made the
verifier accept a following load through R0.
Require a caller frame before indexing it and retrieve the slot with
bpf_get_spilled_stack_arg(). The helper validates the index against
caller->out_stack_arg_cnt and rejects uninitialized slots before the
register state is copied.
Fixes: 0f6bd5e7a804 ("bpf: Support stack arguments for bpf functions")
Reported-by: <[email protected]>
Assisted-by: LLM
Signed-off-by: Weiming Shi <[email protected]>
---
kernel/bpf/verifier.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5f874979b..a67195aa7 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4232,8 +4232,18 @@ static int check_stack_arg_read(struct bpf_verifier_env
*env, struct bpf_func_st
return -EACCES;
}
+ if (!vstate->curframe) {
+ verbose(env, "invalid read from stack arg off %d without
caller\n", off);
+ return -EACCES;
+ }
+
caller = vstate->frame[vstate->curframe - 1];
- arg = &caller->stack_arg_regs[spi];
+ arg = bpf_get_spilled_stack_arg(spi, caller);
+ if (!arg) {
+ verbose(env, "invalid read from uninitialized stack arg off
%d\n", off);
+ return -EACCES;
+ }
+
cur = vstate->frame[vstate->curframe];
bpf_diag_mod_begin(env, &cur->regs[dst_regno], arg, BPF_DIAG_MOD_WRITE);
cur->regs[dst_regno] = *arg;
--
2.55.0
