[PATCH bpf-next v1 2/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame

[Ihor Solodrai <ihor.solodrai@linux.dev>]

bpf_user_ringbuf_drain() peeks a sample, initialises a struct
bpf_dynptr_kern on its own stack, passes it to the callback, and calls
__bpf_user_ringbuf_sample_release() as soon as the callback returns.
Neither the descriptor nor the sample it describes is valid afterwards.

set_user_ringbuf_callback_state() only gives the callback's R1 a type.
The callback can therefore store the CONST_PTR_TO_DYNPTR register into
callback_ctx, which points into a frame that outlives the call, and the
program can use it after the drain returns. Three routes reach past the
callback:

  - the register itself, spillable since v7.3-rc1, which points at a
    descriptor on reused kernel stack and gives the program an arbitrary
    kernel read/write

  - a bpf_dynptr_data() or bpf_dynptr_slice() result, which carries
    the dynptr's id as its parent_id

  - a bpf_dynptr_clone(), which is a by-value copy in the caller's
    frame and can be sliced after the drain returns

Declare R1 frame-scoped so all three are invalidated when the callback
frame is popped.

Reported-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
 kernel/bpf/verifier.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a0a9d3d18f63..9775a6d38d3b 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -707,11 +707,15 @@ static void mark_dynptr_stack_regs(struct bpf_verifier_env *env,
 	__mark_dynptr_reg(sreg2, type, false, id, parent_id);
 }
 
-static void mark_dynptr_cb_reg(struct bpf_verifier_env *env,
-			       struct bpf_reg_state *reg,
+/*
+ * A callback dynptr argument is valid only until the frame is popped, so
+ * setup_func_entry() assigns its id along with the frame reference.
+ */
+static void mark_dynptr_cb_reg(struct bpf_func_state *callee, u32 regno,
 			       enum bpf_dynptr_type type)
 {
-	__mark_dynptr_reg(reg, type, true, ++env->id_gen, 0);
+	__mark_dynptr_reg(&callee->regs[regno], type, true, 0, 0);
+	mark_frame_scoped_arg(callee, regno);
 }
 
 static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env,
@@ -10962,7 +10966,7 @@ static int set_user_ringbuf_callback_state(struct bpf_verifier_env *env,
 	 * callback_fn(const struct bpf_dynptr_t* dynptr, void *callback_ctx);
 	 */
 	bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_0]);
-	mark_dynptr_cb_reg(env, &callee->regs[BPF_REG_1], BPF_DYNPTR_TYPE_LOCAL);
+	mark_dynptr_cb_reg(callee, BPF_REG_1, BPF_DYNPTR_TYPE_LOCAL);
 	callee->regs[BPF_REG_2] = caller->regs[BPF_REG_3];
 
 	/* unused */
-- 
2.55.0