Re: [PATCH bpf-next v1 1/3] bpf: Fix generic __uninit kfunc output buffers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: UBSAN out-of-bounds and NULL pointer arithmetic in mark_raw_stack()
--

commit fc77f675fb39113d85b64af5b859a8ccdbd2caef
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Fix generic __uninit kfunc output buffers

This commit updates the verifier to check generic __uninit memory
arguments as write-only, tracking output sizes per argument slot so a call
can initialize multiple buffers, including those passed on the stack. It
reuses helper raw memory handling to record their definite initialization
after validating all arguments.

Link: https://lore.kernel.org/bpf/86d966ec88bbf27d21b2bb4e18c8aa00@kernel.org

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 6c6b8d8520cdf..070ec5daeec33 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -9550,6 +9556,33 @@ static int check_func_args(struct bpf_verifier_env *env, struct bpf_call_arg_met
>  	return 0;
>  }
>  
> +static int mark_raw_stack(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,
> +			  int insn_idx)
> +{
> +	struct bpf_func_state *caller = cur_func(env);
> +	u32 slot;
> +	int i, err;
> +
> +	/*
> +	 * Validate every argument before initializing outputs: an input argument
> +	 * may alias an output buffer. Use the normal stack-write checks to discard
> +	 * stale spills and preserve the rules for special stack objects.
> +	 */
> +	for (slot = 0; slot < MAX_BPF_FUNC_ARGS; slot++) {
> +		struct bpf_reg_state *reg = get_func_arg_reg(caller, cur_regs(env), slot);

[Severity: High]
Does this unconditional call to get_func_arg_reg() for all MAX_BPF_FUNC_ARGS
slots cause an out-of-bounds or NULL pointer arithmetic issue?

Looking at get_func_arg_reg(), it computes a pointer offset based on the
caller's stack arguments:

kernel/bpf/verifier.c:get_func_arg_reg() {
    ...
    return &caller->stack_arg_regs[arg - MAX_BPF_FUNC_REG_ARGS];
}

Since this loop unconditionally evaluates get_func_arg_reg() for all 12
potential slots (MAX_BPF_FUNC_ARGS), even if meta->arg_raw_mem.size[slot]
is 0, won't this trigger undefined behavior and a UBSAN panic for any
helper or kfunc call where caller->stack_arg_regs is NULL or smaller than
the computed offset?

> +		argno_t argno = argno_from_arg(slot + 1);
> +
> +		for (i = 0; i < meta->arg_raw_mem.size[slot]; i++) {
> +			err = check_mem_access(env, insn_idx, reg, argno, i, BPF_B,
> +					       BPF_WRITE, -1, false, false);
> +			if (err)
> +				return err;
> +		}
> +	}
> +
> +	return 0;
> +}
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915141004.1196460-1-memxor@gmail.com?part=1