Re: [PATCH bpf-next v3 14/17] bpf: Report Policy helper and kfunc errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The verifier reads and dereferences an uninitialized stack variable `meta.func_name` when `bpf_fetch_kfunc_arg_meta` fails early with `-EACCES`, leading to an out-of-bounds read or kernel panic when formatting diagnostic messages.
--

--- Patch [14]: [PATCH bpf-next v3 14/17] bpf: Report Policy helper and kfunc errors ---
commit 64c35288a6fbbafb58f170cb81136c83e594cbdd
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Report Policy helper and kfunc errors

This commit augments selected helper and kfunc allowability failures with
Policy reports to explain which requested operation is forbidden and why.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 44e1907ac792d..c67646f981342 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -13961,8 +13985,14 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>  		return 0;
>  
>  	err = bpf_fetch_kfunc_arg_meta(env, insn->imm, insn->off, &meta);
> -	if (err == -EACCES && meta.func_name)
> +	if (err == -EACCES && meta.func_name) {
>  		verbose(env, "calling kernel function %s is not allowed\n", meta.func_name);
> +		operation = bpf_diag_scratch_printf(env, 1, "kfunc %s", meta.func_name);

[Severity: High]
This is a pre-existing issue, but could meta.func_name be uninitialized here
when bpf_fetch_kfunc_arg_meta() fails early?

Looking at bpf_fetch_kfunc_arg_meta(), if fetch_kfunc_meta() fails and
returns -EACCES, the function returns early before the meta struct is
initialized:

err = fetch_kfunc_meta(env, func_id, offset, &kfunc);
if (err)
	return err;

memset(meta, 0, sizeof(*meta));

Because meta is declared on the stack in check_kfunc_call(), an early error
return leaves it containing uninitialized stack garbage. If this garbage
evaluates to non-NULL in the err == -EACCES && meta.func_name check, won't
this lead to an out-of-bounds memory read when attempting to format the
garbage pointer as a string in verbose() and bpf_diag_scratch_printf()?

> +		bpf_diag_report_policy(env, insn_idx, operation,
> +				       "this program cannot call the kfunc",
> +				       "Use a kfunc allowed for this program type and attach "
> +				       "point, or change the program context.");
> +	}
>  	if (err)
>  		return err;
>  	desc_btf = meta.btf;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713153910.2556007-1-memxor@gmail.com?part=14