Re: [PATCH bpf-next v3 04/10] bpf, x86: add helper to emit kasan checks in x86 JITed programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] emit_kasan_check() fails to save BPF_REG_AX (R10), leading to memory corruption when combined with constant blinding.
--

commit 4c7e1a72bec793ca4ed19fd754408dd627715a3c
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

bpf, x86: add helper to emit kasan checks in x86 JITed programs

This patch adds emit_kasan_check() to emit KASAN shadow memory checks before
memory accesses in x86 JIT-compiled BPF programs. The helper saves temporary
registers before calling the KASAN functions, but deliberately omits r10 and
r11 to reduce overhead.

> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index 054e043ffcd22..68c5f9f94e5e2 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c

[ ... ]

> @@ -1110,6 +1121,90 @@ static void maybe_emit_1mod(u8 **pprog, u32 reg, bool is64)
>  	*pprog = prog;
>  }
>  
> +static int emit_kasan_check(struct bpf_verifier_env *env, u8 **pprog,
> +			    u32 addr_reg, struct bpf_insn *insn, u8 *ip,
> +			    bool is_write, bool accesses_stack_only)
> +{

[ ... ]

> +	/* Save r8 */
> +	EMIT2(0x41, 0x50);
> +	/* Save r9 */
> +	EMIT2(0x41, 0x51);
> +

[Severity: Critical]
Can this lead to data corruption when BPF constant blinding is enabled?

The commit message notes that r10 and r11 are skipped here to reduce
overhead. However, when constant blinding is enabled, bpf_jit_blind_insn()
in kernel/bpf/core.c translates BPF_ST_MEM into a sequence that uses
BPF_REG_AX (which maps to x86's r10) as the source register:

kernel/bpf/core.c:bpf_jit_blind_insn() {
        ...
        case BPF_ST | BPF_MEM | BPF_DW:
                *to++ = BPF_ALU64_IMM(BPF_MOV, BPF_REG_AX, imm_rnd ^ from->imm);
                *to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
                *to++ = BPF_STX_MEM(from->code, from->dst_reg, BPF_REG_AX,
                                    from->off);
        ...
}

When do_jit() processes this BPF_STX_MEM, it first calls emit_kasan_check(),
which invokes the C function __asan_storeX. Since __asan_storeX is a standard
C function, it is permitted by the System V AMD64 ABI to clobber caller-saved
registers like r10.

Upon returning from the KASAN check, r10 might contain garbage. Then do_jit()
calls emit_stx() which will use this clobbered r10 as the data to be written,
potentially writing corrupted data to memory.

Should BPF_REG_AX (r10) be explicitly saved and restored here to prevent this?

> +	/* mov rdi, addr_reg */
> +	EMIT_mov(BPF_REG_1, addr_reg);
> +

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701-kasan-v3-0-bd09bb942d86@bootlin.com?part=4