Re: [PATCH RFC bpf-next 7/8] bpf, x86: enable KASAN for JITed programs on x86

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] The x86 JIT compiler misses KASAN instrumentation for BPF_ST (store immediate to memory) and BPF_ATOMIC (atomic read-modify-write) instructions.
--

commit b74234d98543fb8b6b97cccfe13819f42ebebe33
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

bpf, x86: enable KASAN for JITed programs on x86

Mark x86 as supporting KASAN checks in JITed programs so that the
corresponding JIT compiler inserts checks on the translated
instructions.

> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index f3f7cb01d69d0..cc140108b74c5 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -235,6 +235,7 @@ config X86
>  	select HAVE_SAMPLE_FTRACE_DIRECT	if X86_64
>  	select HAVE_SAMPLE_FTRACE_DIRECT_MULTI	if X86_64
>  	select HAVE_EBPF_JIT
> +	select HAVE_EBPF_JIT_KASAN		if X86_64

Is it safe to enable KASAN for eBPF JIT on x86 when some memory access
instructions appear to be missing KASAN checks?

Looking at arch/x86/net/bpf_jit_comp.c, while BPF_LDX | BPF_MEM and
BPF_STX | BPF_MEM correctly call emit_kasan_check(), BPF_ST | BPF_MEM
and BPF_STX | BPF_ATOMIC directly emit x86 memory access instructions without
instrumentation.

For example, BPF_ST | BPF_MEM does not include the check:

arch/x86/net/bpf_jit_comp.c:do_jit() {
    ...
		case BPF_ST | BPF_MEM | BPF_W:
			if (is_ereg(dst_reg))
				EMIT2(0x41, 0xC7);
			else
				EMIT1(0xC7);
			goto st;
    ...
}

Similarly, atomic operations are missing the check:

arch/x86/net/bpf_jit_comp.c:do_jit() {
    ...
		case BPF_STX | BPF_ATOMIC | BPF_W:
		case BPF_STX | BPF_ATOMIC | BPF_DW:
			if (insn->imm == (BPF_AND | BPF_FETCH) ||
    ...
}

Could this allow an eBPF program to bypass KASAN memory safety validation
by using immediate stores or atomic operations?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260413-kasan-v1-0-1a5831230821@bootlin.com?part=7