Re: [PATCH bpf-next v2 30/43] bpf: avoid widening registers that hinder exact stack-slot tracking

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: call_params_mask() overflows register mask for kfuncs with > 5 args
--

commit 2a8074d95fbbe20d412b57ca9a7f732dfbfaa51d
Author: Eduard Zingerman <eddyz87@gmail.com>

bpf: avoid widening registers that hinder exact stack-slot tracking

This commit adds logic to avoid widening registers used to compute stack
addresses for varying-offset stack accesses during SCEV loop bounds
computations. It collects base registers at loop entry and propagates
them to ensure accurate stack-slot tracking.

> diff --git a/kernel/bpf/scev.c b/kernel/bpf/scev.c
> index a98f3fea52ec0..a093e9bf84b9d 100644
> --- a/kernel/bpf/scev.c
> +++ b/kernel/bpf/scev.c

[ ... ]

> @@ -1060,6 +1060,70 @@ static void reset_scevs_at_indirect_writes(struct bpf_verifier_env *env, struct
>  	}
>  }
>  
> +/*
> + * Collect loop-entry registers referenced by expr 'id', best effort.
> + * DEPTH_LIMIT may leave dependencies unrecorded. This mask only avoids
> + * widening that would lose stack-access precision; missing dependencies
> + * may cause false rejections, but this is not a soundness issue.
> + */
> +static void or_expr_regs(struct bpf_verifier_env *env, u32 id, unsigned long *mask)
> +{
> +	struct scev *scev = env->scev;
> +	u32 order;
> +
> +	scev->stack_sz = 0;
> +	expr_stack_push(scev, id);
> +	while (expr_next(scev, &id, &order)) {
> +		if ((order & PRE) && scev->exprs[id].op == REG)
> +			__set_bit(scev->exprs[id].params[0], mask);
> +	}
> +}
> +
> +/* Mask of argument registers (R1..R5) a call at 'idx' passes by register. */
> +static u16 call_params_mask(struct bpf_verifier_env *env, int idx)
> +{
> +	struct bpf_insn *insn = &env->prog->insnsi[idx];
> +	struct bpf_call_summary cs;
> +	int n = bpf_get_call_summary(env, insn, &cs) ? cs.arg_slot_cnt : MAX_BPF_FUNC_REG_ARGS;
> +
> +	return n ? GENMASK(BPF_REG_1 + n - 1, BPF_REG_1) : 0;
> +}

[Severity: Medium]
Can this regression generate an incorrect register mask if a kfunc takes
more than 5 argument slots?

If bpf_get_call_summary() returns a kfunc with cs.arg_slot_cnt > 5 (since
extra arguments are passed on the stack), n will exceed MAX_BPF_FUNC_REG_ARGS.
Using GENMASK() with n > 5 will overflow into callee-saved registers like
BPF_REG_6 through BPF_REG_10, incorrectly treating them as argument
registers.

Could this pollute base_regs in collect_store_base_regs() and lead to the
verifier falsely rejecting valid BPF programs due to erroneous stack address
dependency tracking?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261004-scev-minimal-rebase-v2-0-f6254e29fdf2@gmail.com?part=30