Re: [PATCH bpf-next v3 07/11] bpf: Allow arena pointers in a by-value kfunc return

[Yonghong Song <yonghong.song@linux.dev>]

On 8/26/26 11:55 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] Kfuncs returning structs by value can leak uninitialized kernel stack memory via struct padding.
> --
>
> commit a43266e4517bac02a4bb85149655178eefda72ad
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf: Allow arena pointers in a by-value kfunc return
>
> This commit allows by-value struct returns from kfuncs to contain arena
> pointers, in addition to scalars. An arena pointer has no provenance to lose
> and can be cast by the program, so returning it as a scalar is safe.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 967ad010b3222..9a36808136c9a 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -14119,13 +14119,17 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>>   
>>   		/*
>>   		 * The returned struct comes back as raw register bits modeled
>> -		 * as an unknown scalar, so it must contain only scalars:
>> -		 * otherwise a pointer field would be laundered into a scalar
>> -		 * and escape provenance and reference tracking.
>> +		 * as an unknown scalar, so a pointer member would be laundered
>> +		 * into a scalar and escape provenance and reference tracking.
>> +		 * Only scalars and arena pointers are allowed: an arena pointer
>> +		 * has no provenance to lose, since a program may already derive
>> +		 * one from any scalar with addr_space_cast(), which confines the
>> +		 * result to the arena.
>>   		 */
>> -		if (!btf_struct_member_walk(env, desc_btf, t, BTF_MEMBER_SCALAR, 0, &path)) {
>> +		if (!btf_struct_member_walk(env, desc_btf, t,
>> +					    BTF_MEMBER_SCALAR | BTF_MEMBER_ARENA_PTR, 0, &path)) {
> [Severity: High]
> This is a pre-existing issue, but does returning structs by value from kfuncs
> leak uninitialized kernel stack memory via struct padding?
>
> When a BPF program calls a kfunc that returns a struct by value (up to 16
> bytes) containing padding bytes, the C compiler leaves the padding bytes
> uninitialized in the return registers (e.g., RAX/RDX on x86-64).
>
> The verifier's check_kfunc_call() processes this using btf_struct_member_walk()
> which ignores padding. The code then calls mark_kfunc_ret_regs() which
> unconditionally marks the entire return registers as fully initialized
> scalar values:
>
> kernel/bpf/verifier.c:mark_kfunc_ret_regs() {
>      ...
>      mark_reg_unknown(env, regs, ret_regs[0]);
>      if (nregs == 1)
>          return nregs;
>
>      for (i = 1; i < nregs; i++) {
>          mark_reg_unknown(env, regs, ret_regs[i]);
>      }
>      ...
> }
>
> Can a BPF program then read these registers and exfiltrate the uninitialized
> padding bytes (e.g., via BPF maps)?

We should be okay. Based on type, the return register will do proper narrowing
e.g., zeroing out the upper 32bit value, etc.

>