Re: [PATCH bpf-next v3 1/2] bpf: Reject MEM_ALLOC BTF accesses past object bounds

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incomplete fix for out-of-bounds flex-array access on locally allocated objects. An attacker can bypass the new `!type_is_alloc(reg->type)` check by stripping the `MEM_ALLOC` flag from the pointer, re-enabling the flex-array relaxation and allowing out-of-bounds kernel memory reads.
--

commit 58fdae86cafcb299054bb852079f413faa582d91
Author: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>

bpf: Reject MEM_ALLOC BTF accesses past object bounds

This patch aims to prevent out-of-bounds accesses past object bounds when
accessing objects with a trailing flexible array. It restricts the
flexible-array bounds relaxation when the register points to a locally
allocated object.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 64572f85edc83..dff5c0d916412 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
[ ... ]
> @@ -7404,7 +7407,8 @@ int btf_struct_access(struct bpf_verifier_log *log,
>  
>  	t = btf_type_by_id(btf, id);
>  	do {
> -		err = btf_struct_walk(log, btf, t, off, size, &id, &tmp_flag, field_name);
> +		err = btf_struct_walk(log, btf, t, off, size, &id, &tmp_flag,
> +				      field_name, !type_is_alloc(reg->type));

[Severity: High]
This is a pre-existing issue, but does this check completely prevent the
out-of-bounds flex-array access?

If a BPF program allocates a local object via bpf_obj_new(), the memory is
allocated strictly based on t->size with no extra room for a flexible array.

However, if the MEM_ALLOC flag is later stripped from the pointer, the check
!type_is_alloc(reg->type) will evaluate to true. This flag stripping can happen
if the pointer is cast using bpf_rdonly_cast(), or if it is stored as an
unreferenced kptr in a map and loaded outside an RCU critical section.

Could this allow a program to bypass this new fix, re-enable the flex-array
bounds relaxation in btf_struct_walk(), and perform an out-of-bounds read of
adjacent SLUB allocator objects using PROBE_MEM semantics?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1782807039.git.chenyy23@mails.tsinghua.edu.cn?part=1