Re: [PATCH bpf-next v2 14/18] bpf: Check helper mem+size in ARG_PTR_TO_MEM case

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling check_mem_size_reg() on the size register before validating its type allows an unprivileged user to trigger a kernel warning (WARN_ONCE) and potential panic, leading to a local Denial of Service.
--

--- Patch [14]: [PATCH bpf-next v2 14/18] bpf: Check helper mem+size in ARG_PTR_TO_MEM case ---
commit 49ede5ce4d16f1df74560df7eef17176d13cb3e1
Author: Amery Hung <ameryhung@gmail.com>

bpf: Check helper mem+size in ARG_PTR_TO_MEM case

This commit modifies the BPF verifier to check variable-size memory arguments
and their associated size registers simultaneously during the ARG_PTR_TO_MEM
case, rather than waiting for the ARG_MEM_SIZE argument. It looks ahead to
regno + 1 to process the size register.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 144c2d8aa4922..2326b12a15313 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -8515,14 +8512,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>  				return err;
>  			if (arg_type & MEM_ALIGNED)
>  				err = check_ptr_alignment(env, reg, 0, fn->arg_size[arg], true);
> +		} else {
> +			struct bpf_reg_state *size_reg = reg_state(env, regno + 1);
> +
> +			err = check_mem_size_reg(env, reg, size_reg, argno,
> +						 argno_from_reg(regno + 1),
> +						 arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ,
> +						 fn->arg_type[arg + 1] & SCALAR_MAYBE_ZERO, meta);

[Severity: High]
Could this call to check_mem_size_reg() process a non-scalar register?

By looking ahead and processing size_reg at regno + 1 here, it seems this is
happening before the size register's type is validated in the next loop
iteration of check_func_arg().

If a BPF program passes a pointer (like PTR_TO_MAP_VALUE with var_off=0)
instead of a scalar for the size argument, it appears it would bypass the
scalar bounds checks. When check_mem_size_reg() subsequently calls
mark_chain_precision() on that non-scalar register, could this trigger a
verifier_bug() and BPF_WARN_ONCE()?

On systems with panic_on_warn enabled, this might lead to a local denial
of service.

>  		}
>  		break;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724190813.1458271-1-ameryhung@gmail.com?part=14