Re: [PATCH bpf-next v3 06/10] bpf, x86: emit KASAN checks into x86 JITed programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] emit_kasan_check fails to save and restore x86 caller-saved registers R10 (BPF_REG_AX) and R11 (AUX_REG), causing BPF register corruption.
--

commit f9acd1352526b0ce263a176070ea1146c5f57a4a
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

bpf, x86: emit KASAN checks into x86 JITed programs

Insert KASAN shadow memory checks before memory load and store
operations in JIT-compiled BPF programs. This helps detect memory safety
bugs such as use-after-free and out-of-bounds accesses at runtime.

> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index b70cecfec1793..a383ffc8f2899 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c

[ ... ]

> @@ -2605,14 +2640,14 @@ static int do_jit(struct bpf_verifier_env *env, struct bpf_prog *bpf_prog, int *
>  			}
>  			fallthrough;
>  		case BPF_STX | BPF_ATOMIC | BPF_W:
> -		case BPF_STX | BPF_ATOMIC | BPF_DW:
> +		case BPF_STX | BPF_ATOMIC | BPF_DW: {
> +			bool is64 = BPF_SIZE(insn->code) == BPF_DW;
> +			u32 real_src_reg = src_reg;
> +			u32 real_dst_reg = dst_reg;
> +			u8 *branch_target;
>  			if (insn->imm == (BPF_AND | BPF_FETCH) ||
>  			    insn->imm == (BPF_OR | BPF_FETCH) ||
>  			    insn->imm == (BPF_XOR | BPF_FETCH)) {
>  
>  				/*
>  				 * Can't be implemented with a single x86 insn.
> @@ -2626,7 +2661,19 @@ static int do_jit(struct bpf_verifier_env *env, struct bpf_prog *bpf_prog, int *
>  				if (dst_reg == BPF_REG_0)
>  					real_dst_reg = BPF_REG_AX;
>  
> +				ip += 3;
> +			}
> +			if (!bpf_atomic_is_load_store(insn)) {
> +				err = emit_kasan_check(env, &prog, real_dst_reg,
> +						       insn, ip, false,
> +						       accesses_stack_only);

[Severity: Critical]
Does emit_kasan_check() correctly preserve x86 caller-saved registers like R10
(BPF_REG_AX) and R11 (AUX_REG)?

Looking at emit_kasan_check(), it saves r8 and r9 before the C function call 
but seems to miss saving r10 and r11:

    /* Save rdi */
    EMIT1(0x57);
    /* Save r8 */
    EMIT2(0x41, 0x50);
    /* Save r9 */
    EMIT2(0x41, 0x51);

    /* mov rdi, addr_reg */

Because the x86-64 System V ABI allows C functions like __asan_load* to 
clobber R10 and R11, failing to save and restore them before the call can 
corrupt BPF registers.

For example, in the atomic block above, BPF_REG_AX (R10) is used to temporarily
save BPF_REG_0 across the emit_kasan_check() call. If __asan_load* clobbers
BPF_REG_AX, the restored BPF_REG_0 will contain garbage, which could be used to
bypass verifier checks and lead to out-of-bounds kernel memory accesses.

> +				if (err)
> +					return err;
>  				branch_target = prog;
> +			}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701-kasan-v3-0-bd09bb942d86@bootlin.com?part=6