[PATCH bpf v2 0/2] bpf: Reject non-negative stack object offsets

[PATCH bpf v2 0/2] bpf: Reject non-negative stack object offsets

[Xu Yunxiang]

Reject non-negative offsets before converting a stack object address to a
stack slot index. Add a regression test for iterator destruction through
fp+0.

Changes in v2:
- Split the kernel change and selftest as requested by Andrii.
- Rebase onto bpf/master at a11212910cf09b2fe8db9afa41ef60c4f81879c5.
- Keep the original code and test changes unchanged and retain Sun Jian's
  Reviewed-by on both parts.

v1: https://lore.kernel.org/bpf/20260911084314.3481637-1-xyx2021@mail.ustc.edu.cn/
Split request: https://lore.kernel.org/bpf/CAEf4BzbYzt-Riekpc-A=MfQft9ZELwSDSE8kkQO1ZOyR3O_FAg@mail.gmail.com/

Validation on this exact candidate with a matching bpf_testmod:
  - W=1 verifier, full kernel/modules, changed BPF objects and test_progs
    builds passed.
  - iters: 1/97 passed; 0 skipped.
  - dynptr: 2/132 passed; 0 skipped.
  - irq: 1/33 passed; 0 skipped.
  - res_spin_lock: 3/14 passed; 1 skipped.
  - file_reader: 1/8 passed; 0 skipped.
  - kmem_cache_iter: 1/3 passed; 0 skipped.
  - dmabuf_iter: 1/4 passed; 0 skipped.

No selected test failed. The VM ran with panic_on_warn and panic_on_oops;
no kernel WARN, Oops or panic was found.

res_spin_lock_stress skips because the VM has no hardware PMU.

Annotated verifier tests check load outcomes and diagnostics. The full
unfiltered suite, sanitizer configurations and architecture matrix were
not run.

Please queue this fix for stable after it reaches the BPF tree.

Xu Yunxiang (2):
  bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
  selftests/bpf: Reject iterator destruction through fp+0

 kernel/bpf/verifier.c                         |  2 +-
 .../selftests/bpf/progs/iters_state_safety.c  | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)


base-commit: a11212910cf09b2fe8db9afa41ef60c4f81879c5
-- 
2.43.0

[PATCH bpf v2 1/2] bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

[Xu Yunxiang]

bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division,
which truncates toward zero. For off == 0, this produces spi 0, the
same index used by the valid stack slot at fp-8.

stack_slot_obj_get_spi() currently checks alignment and the resulting
spi bounds, but does not reject the non-negative offset itself. It can
therefore validate a PTR_TO_STACK register holding fp+0 against an
iterator stored at fp-8 even though the runtime receives the actual fp+0
pointer. An effectful iterator kfunc can then interpret memory outside
the BPF stack as iterator state.

Reject non-negative offsets before converting the offset to an spi. All
valid stack objects begin at a negative offset from the frame pointer.

Fixes: 06accc8779c1 ("bpf: add support for open-coded iterator loops")
Assisted-by: LLM
Reviewed-by: Sun Jian <sun.jian.kdev@gmail.com>
Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 02be326f235c1..dd8bb179d39eb 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -567,7 +567,7 @@ static int stack_slot_obj_get_spi(struct bpf_verifier_env *env, struct bpf_reg_s
 	}
 
 	off = reg->var_off.value;
-	if (off % BPF_REG_SIZE) {
+	if (off >= 0 || off % BPF_REG_SIZE) {
 		verbose(env, "cannot pass in %s at an offset=%d\n", obj_kind, off);
 		return -EINVAL;
 	}
-- 
2.43.0

[PATCH bpf v2 2/2] selftests/bpf: Reject iterator destruction through fp+0

[Xu Yunxiang]

Add a verifier regression test that initializes a numeric iterator at fp-8
and attempts to destroy it through fp+0. The verifier must reject the
non-negative offset instead of treating it as the initialized stack slot.

Check the offset diagnostic to ensure rejection happens at the stack
object address check. The numeric iterator destroy operation is a no-op;
this test checks verifier rejection and does not run the program.

Assisted-by: LLM
Reviewed-by: Sun Jian <sun.jian.kdev@gmail.com>
Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
---
 .../selftests/bpf/progs/iters_state_safety.c  | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/iters_state_safety.c b/tools/testing/selftests/bpf/progs/iters_state_safety.c
index 646026430e9b5..e5bb9fe6d5e53 100644
--- a/tools/testing/selftests/bpf/progs/iters_state_safety.c
+++ b/tools/testing/selftests/bpf/progs/iters_state_safety.c
@@ -52,6 +52,28 @@ int create_and_destroy(void *ctx)
 	return 0;
 }
 
+/* fp+0 is not a stack slot. bpf_get_spi(0) used to alias spi 0 (fp-8). */
+SEC("?raw_tp")
+__failure __msg("cannot pass in iter at an offset=0")
+int destroy_fp0_fail(void *ctx)
+{
+	struct bpf_iter_num iter;
+
+	asm volatile ("r1 = %[iter];"
+		"r2 = 0;"
+		"r3 = 1000;"
+		"call %[bpf_iter_num_new];"
+		/* r10 is fp+0, one byte above the top of the BPF stack */
+		"r1 = r10;"
+		"call %[bpf_iter_num_destroy];"
+		:
+		: __imm_ptr(iter), ITER_HELPERS
+		: __clobber_common
+	);
+
+	return 0;
+}
+
 SEC("?raw_tp")
 __failure __msg("Unreleased reference id=1")
 int create_and_forget_to_destroy_fail(void *ctx)
-- 
2.43.0

Re: [PATCH bpf v2 0/2] bpf: Reject non-negative stack object offsets

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Mon, 21 Sep 2026 05:04:20 +0800 you wrote:
> Reject non-negative offsets before converting a stack object address to a
> stack slot index. Add a regression test for iterator destruction through
> fp+0.
> 
> Changes in v2:
> - Split the kernel change and selftest as requested by Andrii.
> - Rebase onto bpf/master at a11212910cf09b2fe8db9afa41ef60c4f81879c5.
> - Keep the original code and test changes unchanged and retain Sun Jian's
>   Reviewed-by on both parts.
> 
> [...]

Here is the summary with links:
  - [bpf,v2,1/2] bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
    https://git.kernel.org/bpf/bpf/c/79a9172f3ab4
  - [bpf,v2,2/2] selftests/bpf: Reject iterator destruction through fp+0
    https://git.kernel.org/bpf/bpf/c/8244668cbbff

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html