[PATCH bpf v3 0/2] Fix stale register bounds on LSM retval context load

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

check_mem_access() calls __mark_reg_s32_range() to narrow a register to
the LSM hook retval range, but the intersection preserves stale bounds
from prior instructions. Add mark_reg_unknown() before narrowing (same
pattern as the else branch) and a selftest that catches the mismatch.

Changes in v3:
- Add selftest demonstrating the issue (Eduard Zingerman)
- No code change in patch 1 from v2

Tristan Madani (2):
  bpf: Reset register bounds before narrowing retval range in
    check_mem_access()
  selftests/bpf: Add test for stale bounds on LSM retval context load

 kernel/bpf/verifier.c                            |  1 +
 tools/testing/selftests/bpf/progs/verifier_lsm.c | 15 +++++++++++++++
 2 files changed, 16 insertions(+)

-- 
2.47.3