[PATCH bpf-next v2 1/2] bpf: Validate outgoing stack args when btf_prepare_func_args fails

[PATCH bpf-next v2 1/2] bpf: Validate outgoing stack args when btf_prepare_func_args fails

[Yonghong Song]

btf_prepare_func_args() sets sub->arg_cnt before validating arg types.
If validation fails (e.g. unsupported pointer type in a static subprog),
check_outgoing_stack_args() is skipped because btf_check_func_arg_match()
returns early. For static subprogs, check_func_call() ignores non-EFAULT
errors and proceeds with the call.

This causes the callee to read stack arg slots that the caller never
stored or not initialized, potentially dereferencing NULL caller->stack_arg_regs
or getting no-initialized value.

To fix the issue, when btf_prepare_func_args() fails and the subprog expects
stack args, call check_outgoing_stack_args() to verify the caller initialized
the slots. Return -EFAULT on failure so the error is not ignored.

Fixes: 3ab5bd317ee2 ("bpf: Set sub->arg_cnt earlier in btf_prepare_func_args()")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 kernel/bpf/verifier.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Changelogs:
  v1 -> v2:
    - v1: https://lore.kernel.org/bpf/20260514184827.1619863-1-yonghong.song@linux.dev/
    - Remove Reported-by (Sashiko) and add Fixes tag.

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 76a07f09ab64..8dd79b735a69 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9118,11 +9118,17 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
 	struct bpf_func_state *caller = cur_func(env);
 	struct bpf_verifier_log *log = &env->log;
 	u32 i;
-	int ret;
+	int ret, err;
 
 	ret = btf_prepare_func_args(env, subprog);
-	if (ret)
+	if (ret) {
+		if (bpf_in_stack_arg_cnt(sub) > 0) {
+			err = check_outgoing_stack_args(env, caller, sub->arg_cnt);
+			if (err)
+				return err;
+		}
 		return ret;
+	}
 
 	ret = check_outgoing_stack_args(env, caller, sub->arg_cnt);
 	if (ret)
-- 
2.53.0-Meta

[PATCH bpf-next v2 2/2] selftests/bpf: Add test for stack arg read without caller write

[Yonghong Song]

Add negative tests for the outgoing stack arg validation.
A static subprog with a 'long *' arg causes
btf_prepare_func_args() to fail after setting arg_cnt. The
validation ensures check_outgoing_stack_args() still runs.

Also update two existing tests (release_ref, stale_pkt_ptr) whose
expected error messages changed: invalidated stack arg slots are now
caught by check_outgoing_stack_args() at the call site instead of
at the callee's dereference.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 .../bpf/progs/btf__verifier_stack_arg_order.c |  8 +++
 .../selftests/bpf/progs/verifier_stack_arg.c  |  4 +-
 .../bpf/progs/verifier_stack_arg_order.c      | 58 +++++++++++++++++++
 3 files changed, 68 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c b/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
index da34e8456b6c..99bc115f8380 100644
--- a/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
+++ b/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
@@ -21,6 +21,10 @@ int subprog_pruning_call_before_load_6args(int a, int b, int c, int d, int e, in
 	return a + b + c + d + e + f;
 }
 
+void subprog_bad_ptr_7args(long *a, int b, int c, int d, int e, int f, int g)
+{
+}
+
 #else
 
 int subprog_bad_order_6args(void)
@@ -38,4 +42,8 @@ int subprog_pruning_call_before_load_6args(void)
 	return 0;
 }
 
+void subprog_bad_ptr_7args(void)
+{
+}
+
 #endif
diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
index d43a9b42034c..d45339b83795 100644
--- a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
+++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
@@ -152,7 +152,7 @@ __naked void stack_arg_pruning_type_mismatch(void)
 SEC("tc")
 __description("stack_arg: release_reference invalidates stack arg slot")
 __failure
-__msg("R{{[0-9]}} !read_ok")
+__msg("callee expects 6 args, stack arg1 is not initialized")
 __naked void stack_arg_release_ref(void)
 {
 	asm volatile (
@@ -201,7 +201,7 @@ __naked void stack_arg_release_ref(void)
 SEC("tc")
 __description("stack_arg: pkt pointer in stack arg slot invalidated after pull_data")
 __failure
-__msg("R{{[0-9]}} !read_ok")
+__msg("callee expects 6 args, stack arg1 is not initialized")
 __naked void stack_arg_stale_pkt_ptr(void)
 {
 	asm volatile (
diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
index 1240cf8a40d6..c9fe4857da3f 100644
--- a/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
+++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
@@ -112,6 +112,64 @@ __naked void stack_arg_pruning_load_after_call(void)
 	);
 }
 
+/*
+ * "bad_ptr": the first arg is 'long *', which is not a recognized pointer
+ * type for static subprogs (not ctx, dynptr, or tagged).  btf_prepare_func_args()
+ * sets arg_cnt = 7 / stack_arg_cnt = 2, then fails with -EINVAL.  The subprog
+ * is marked unreliable but the call still proceeds for static subprogs.
+ */
+__noinline __used __naked
+static void subprog_bad_ptr_7args(long *a, int b, int c, int d, int e, int f, int g)
+{
+	asm volatile (
+		"r0 = *(u64 *)(r11 + 8);"
+		"r1 = *(u64 *)(r11 + 16);"
+		"exit;"
+		::: __clobber_all
+	);
+}
+
+SEC("tc")
+__description("stack_arg: read without caller write")
+__failure
+__msg("callee expects 7 args, stack arg1 is not initialized")
+__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
+__naked void stack_arg_read_without_write_1(void)
+{
+	asm volatile (
+		"r1 = 0;"
+		"r2 = 0;"
+		"r3 = 0;"
+		"r4 = 0;"
+		"r5 = 0;"
+		"call subprog_bad_ptr_7args;"
+		"exit;"
+		::: __clobber_all
+	);
+}
+
+SEC("tc")
+__description("stack_arg: read with not-initialized caller write")
+__failure
+__msg("R0 !read_ok")
+__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
+__naked void stack_arg_read_without_write_2(void)
+{
+	asm volatile (
+		"r1 = 0;"
+		"r2 = 0;"
+		"r3 = 0;"
+		"r4 = 0;"
+		"r5 = 0;"
+		"*(u64 *)(r11 - 8) = 0;"
+		"*(u64 *)(r11 - 16) = 0;"
+		"call subprog_bad_ptr_7args;"
+		"call subprog_bad_ptr_7args;"
+		"exit;"
+		::: __clobber_all
+	);
+}
+
 #else
 
 SEC("socket")
-- 
2.53.0-Meta

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Add test for stack arg read without caller write

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 4654 bytes --]

> diff --git a/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c b/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
> index da34e8456b6c..99bc115f8380 100644
> --- a/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
> +++ b/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c

[ ... ]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
> index d43a9b42034c..d45339b83795 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
> @@ -152,7 +152,7 @@ __naked void stack_arg_pruning_type_mismatch(void)
>  SEC("tc")
>  __description("stack_arg: release_reference invalidates stack arg slot")
>  __failure
> -__msg("R{{[0-9]}} !read_ok")
> +__msg("callee expects 6 args, stack arg1 is not initialized")
>  __naked void stack_arg_release_ref(void)

[ ... ]

>  SEC("tc")
>  __description("stack_arg: pkt pointer in stack arg slot invalidated after pull_data")
>  __failure
> -__msg("R{{[0-9]}} !read_ok")
> +__msg("callee expects 6 args, stack arg1 is not initialized")
>  __naked void stack_arg_stale_pkt_ptr(void)

[ ... ]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
> index 1240cf8a40d6..c9fe4857da3f 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
> @@ -112,6 +112,64 @@ __naked void stack_arg_pruning_load_after_call(void)
>  	);
>  }
>
> +/*
> + * "bad_ptr": the first arg is 'long *', which is not a recognized pointer
> + * type for static subprogs (not ctx, dynptr, or tagged).  btf_prepare_func_args()
> + * sets arg_cnt = 7 / stack_arg_cnt = 2, then fails with -EINVAL.  The subprog
> + * is marked unreliable but the call still proceeds for static subprogs.
> + */
> +__noinline __used __naked
> +static void subprog_bad_ptr_7args(long *a, int b, int c, int d, int e, int f, int g)
> +{
> +	asm volatile (
> +		"r0 = *(u64 *)(r11 + 8);"
> +		"r1 = *(u64 *)(r11 + 16);"
> +		"exit;"
> +		::: __clobber_all
> +	);
> +}
> +
> +SEC("tc")
> +__description("stack_arg: read without caller write")
> +__failure
> +__msg("callee expects 7 args, stack arg1 is not initialized")
> +__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
> +__naked void stack_arg_read_without_write_1(void)
> +{
> +	asm volatile (
> +		"r1 = 0;"
> +		"r2 = 0;"
> +		"r3 = 0;"
> +		"r4 = 0;"
> +		"r5 = 0;"
> +		"call subprog_bad_ptr_7args;"
> +		"exit;"
> +		::: __clobber_all
> +	);
> +}
> +
> +SEC("tc")
> +__description("stack_arg: read with not-initialized caller write")
> +__failure
> +__msg("R0 !read_ok")

Is the expected error message correct here? Looking at
stack_arg_read_without_write_1 (the test just above), it expects the
new-style message "callee expects 7 args, stack arg1 is not
initialized" when calling subprog_bad_ptr_7args without writing to the
stack. This test (stack_arg_read_without_write_2) also calls
subprog_bad_ptr_7args without properly initializing the stack args, but
expects the old-style message "R0 !read_ok" instead.

The commit message explains that invalidated stack arg slots are now
caught by check_outgoing_stack_args() at the call site instead of at
the callee's dereference, which led to updating the expected messages
in stack_arg_release_ref and stack_arg_stale_pkt_ptr from "R0
!read_ok" to "callee expects 6 args, stack arg1 is not initialized".

This test writes to r11-8 and r11-16 (stack args for the 6th and 7th
parameters), then calls subprog_bad_ptr_7args twice without rewriting
the stack between calls. The pattern matches stack_arg_sequential_calls
in verifier_stack_arg.c which expects the new-style error message.

Should this test expect "callee expects 7 args, stack arg1 is not
initialized" to be consistent with the other tests and the commit's
stated behavior change?

> +__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
> +__naked void stack_arg_read_without_write_2(void)
> +{
> +	asm volatile (
> +		"r1 = 0;"
> +		"r2 = 0;"
> +		"r3 = 0;"
> +		"r4 = 0;"
> +		"r5 = 0;"
> +		"*(u64 *)(r11 - 8) = 0;"
> +		"*(u64 *)(r11 - 16) = 0;"
> +		"call subprog_bad_ptr_7args;"
> +		"call subprog_bad_ptr_7args;"
> +		"exit;"
> +		::: __clobber_all
> +	);
> +}


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/25896151874

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Add test for stack arg read without caller write

[Yonghong Song]

On 5/15/26 4:31 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c b/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
>> index da34e8456b6c..99bc115f8380 100644
>> --- a/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
>> +++ b/tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
> [ ... ]
>
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>> index d43a9b42034c..d45339b83795 100644
>> --- a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>> @@ -152,7 +152,7 @@ __naked void stack_arg_pruning_type_mismatch(void)
>>   SEC("tc")
>>   __description("stack_arg: release_reference invalidates stack arg slot")
>>   __failure
>> -__msg("R{{[0-9]}} !read_ok")
>> +__msg("callee expects 6 args, stack arg1 is not initialized")
>>   __naked void stack_arg_release_ref(void)
> [ ... ]
>
>>   SEC("tc")
>>   __description("stack_arg: pkt pointer in stack arg slot invalidated after pull_data")
>>   __failure
>> -__msg("R{{[0-9]}} !read_ok")
>> +__msg("callee expects 6 args, stack arg1 is not initialized")
>>   __naked void stack_arg_stale_pkt_ptr(void)
> [ ... ]
>
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
>> index 1240cf8a40d6..c9fe4857da3f 100644
>> --- a/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
>> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
>> @@ -112,6 +112,64 @@ __naked void stack_arg_pruning_load_after_call(void)
>>   	);
>>   }
>>
>> +/*
>> + * "bad_ptr": the first arg is 'long *', which is not a recognized pointer
>> + * type for static subprogs (not ctx, dynptr, or tagged).  btf_prepare_func_args()
>> + * sets arg_cnt = 7 / stack_arg_cnt = 2, then fails with -EINVAL.  The subprog
>> + * is marked unreliable but the call still proceeds for static subprogs.
>> + */
>> +__noinline __used __naked
>> +static void subprog_bad_ptr_7args(long *a, int b, int c, int d, int e, int f, int g)
>> +{
>> +	asm volatile (
>> +		"r0 = *(u64 *)(r11 + 8);"
>> +		"r1 = *(u64 *)(r11 + 16);"
>> +		"exit;"
>> +		::: __clobber_all
>> +	);
>> +}
>> +
>> +SEC("tc")
>> +__description("stack_arg: read without caller write")
>> +__failure
>> +__msg("callee expects 7 args, stack arg1 is not initialized")
>> +__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
>> +__naked void stack_arg_read_without_write_1(void)
>> +{
>> +	asm volatile (
>> +		"r1 = 0;"
>> +		"r2 = 0;"
>> +		"r3 = 0;"
>> +		"r4 = 0;"
>> +		"r5 = 0;"
>> +		"call subprog_bad_ptr_7args;"
>> +		"exit;"
>> +		::: __clobber_all
>> +	);
>> +}
>> +
>> +SEC("tc")
>> +__description("stack_arg: read with not-initialized caller write")
>> +__failure
>> +__msg("R0 !read_ok")
> Is the expected error message correct here? Looking at
> stack_arg_read_without_write_1 (the test just above), it expects the
> new-style message "callee expects 7 args, stack arg1 is not
> initialized" when calling subprog_bad_ptr_7args without writing to the
> stack. This test (stack_arg_read_without_write_2) also calls
> subprog_bad_ptr_7args without properly initializing the stack args, but
> expects the old-style message "R0 !read_ok" instead.
>
> The commit message explains that invalidated stack arg slots are now
> caught by check_outgoing_stack_args() at the call site instead of at
> the callee's dereference, which led to updating the expected messages
> in stack_arg_release_ref and stack_arg_stale_pkt_ptr from "R0
> !read_ok" to "callee expects 6 args, stack arg1 is not initialized".
>
> This test writes to r11-8 and r11-16 (stack args for the 6th and 7th
> parameters), then calls subprog_bad_ptr_7args twice without rewriting
> the stack between calls. The pattern matches stack_arg_sequential_calls
> in verifier_stack_arg.c which expects the new-style error message.
>
> Should this test expect "callee expects 7 args, stack arg1 is not
> initialized" to be consistent with the other tests and the commit's
> stated behavior change?

I think it should be okay. The first subprog_bad_ptr_7args()
will go through arg checking in btf_check_func_arg_match().

But the second call subprog_bad_ptr_7args() will not go through
btf_check_func_arg_match() since the subprog btf_id has been
calculated in the first subprog_bad_ptr_7args() and the verifier
simply reuse the btf_id. Due to this, the validation
check_outgoing_stack_args() inside btf_check_func_arg_match()
is not triggered.

Since there is no intermediate r11-based store, the callee
gets a 'not initialized' value for r0 and eventually gets
an error message 'R0 !read_ok' indicating the return value
is not valid.

>
>> +__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
>> +__naked void stack_arg_read_without_write_2(void)
>> +{
>> +	asm volatile (
>> +		"r1 = 0;"
>> +		"r2 = 0;"
>> +		"r3 = 0;"
>> +		"r4 = 0;"
>> +		"r5 = 0;"
>> +		"*(u64 *)(r11 - 8) = 0;"
>> +		"*(u64 *)(r11 - 16) = 0;"
>> +		"call subprog_bad_ptr_7args;"
>> +		"call subprog_bad_ptr_7args;"
>> +		"exit;"
>> +		::: __clobber_all
>> +	);
>> +}
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/25896151874

Re: [PATCH bpf-next v2 1/2] bpf: Validate outgoing stack args when btf_prepare_func_args fails

[Yonghong Song]

On 5/15/26 3:49 AM, Yonghong Song wrote:
> btf_prepare_func_args() sets sub->arg_cnt before validating arg types.
> If validation fails (e.g. unsupported pointer type in a static subprog),
> check_outgoing_stack_args() is skipped because btf_check_func_arg_match()
> returns early. For static subprogs, check_func_call() ignores non-EFAULT
> errors and proceeds with the call.
>
> This causes the callee to read stack arg slots that the caller never
> stored or not initialized, potentially dereferencing NULL caller->stack_arg_regs
> or getting no-initialized value.
>
> To fix the issue, when btf_prepare_func_args() fails and the subprog expects
> stack args, call check_outgoing_stack_args() to verify the caller initialized
> the slots. Return -EFAULT on failure so the error is not ignored.
>
> Fixes: 3ab5bd317ee2 ("bpf: Set sub->arg_cnt earlier in btf_prepare_func_args()")
> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> ---
>   kernel/bpf/verifier.c | 10 ++++++++--
>   1 file changed, 8 insertions(+), 2 deletions(-)
>
> Changelogs:
>    v1 -> v2:
>      - v1: https://lore.kernel.org/bpf/20260514184827.1619863-1-yonghong.song@linux.dev/
>      - Remove Reported-by (Sashiko) and add Fixes tag.
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 76a07f09ab64..8dd79b735a69 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -9118,11 +9118,17 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
>   	struct bpf_func_state *caller = cur_func(env);
>   	struct bpf_verifier_log *log = &env->log;
>   	u32 i;
> -	int ret;
> +	int ret, err;
>   
>   	ret = btf_prepare_func_args(env, subprog);
> -	if (ret)
> +	if (ret) {
> +		if (bpf_in_stack_arg_cnt(sub) > 0) {
> +			err = check_outgoing_stack_args(env, caller, sub->arg_cnt);
> +			if (err)
> +				return err;
> +		}
>   		return ret;
> +	}
>   
>   	ret = check_outgoing_stack_args(env, caller, sub->arg_cnt);
>   	if (ret)

Please ignore this patch set. There are more issues related to stack arguments.
I have consolidated them into v3:
     https://lore.kernel.org/bpf/20260515225035.821178-1-yonghong.song@linux.dev/