Re: [PATCH bpf-next v4 02/10] bpf: mark instructions accessing program stack

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] In `adjust_insn_aux_data()`, when replacing an instruction with a single new instruction (`cnt == 1`), `data[off].non_stack_access` is incorrectly set by evaluating `is_mem_insn(insn)` instead of `is_mem_insn(insn + off)`.
--

--- Patch [2]: [PATCH bpf-next v4 02/10] bpf: mark instructions accessing program stack ---
commit 764c11844e954d2fc0370d170803b0deb684733a
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

bpf: mark instructions accessing program stack

This commit introduces tracking of instructions that access non-stack memory
to help JIT compilers emit KASAN checks. It adds logic to mark BPF
instructions as stack-only by default and overrides this if any state
indicates non-stack access, including adjustments during verifier patching.

> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
> index f515fc9669ce2..feee1f33de9d5 100644
> --- a/kernel/bpf/fixups.c
> +++ b/kernel/bpf/fixups.c

[ ... ]

> @@ -172,8 +184,14 @@ static void adjust_insn_aux_data(struct bpf_verifier_env *env,
>  	 */
>  	data[off].zext_dst = insn_has_def32(insn + off + cnt - 1);
>  
> -	if (cnt == 1)
> +	if (cnt == 1) {
> +		/* A non-memory accessing insn could have been replaced by a
> +		 * memory accessing insn, systematically mark it for non-stack
> +		 * access
> +		 */
> +		data[off].non_stack_access = is_mem_insn(insn);

[Severity: High]
Should this check be using is_mem_insn(insn + off) instead of
is_mem_insn(insn)?

Since insn points to the start of the program (new_prog->insnsi), calling
is_mem_insn(insn) evaluates the very first instruction of the program rather
than the newly patched instruction at the targeted offset.

If the first instruction happens to not be a memory access, will this
incorrectly mark the patched instruction as not accessing non-stack memory
and cause us to miss KASAN instrumentation?

>  		return;
> +	}
>  	prog_len = new_prog->len;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-kasan-v4-0-d5c177ab8227@bootlin.com?part=2