Re: [PATCH bpf-next v4 07/10] bpf, x86: enable KASAN for JITed programs on x86

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The KASAN check emitted by the x86 BPF JIT clobbers the caller-saved registers r10 (BPF_REG_AX) and r11 (AUX_REG), leading to memory corruption.
--

--- Patch [7]: [PATCH bpf-next v4 07/10] bpf, x86: enable KASAN for JITed programs on x86 ---
commit 4ee1a38a02c8227bc35c998032951cf3c95c2d7d
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

bpf, x86: enable KASAN for JITed programs on x86

Mark x86 as supporting KASAN checks in JITed programs so that the
corresponding JIT compiler inserts checks on the translated
instructions.

> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index bdad90f210e4b..705a9ab85f3a9 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -233,6 +233,7 @@ config X86
>  	select HAVE_SAMPLE_FTRACE_DIRECT	if X86_64
>  	select HAVE_SAMPLE_FTRACE_DIRECT_MULTI	if X86_64
>  	select HAVE_EBPF_JIT
> +	select HAVE_EBPF_JIT_KASAN		if X86_64
[Severity: Critical]
Does enabling this feature introduce memory corruption by exposing a bug in
emit_kasan_check()?

Looking at arch/x86/net/bpf_jit_comp.c:emit_kasan_check(), caller-saved
registers (rax through r9) are pushed, but r10 (BPF_REG_AX) and r11 (AUX_REG)
are explicitly missing. This exposes them to clobbering by the KASAN C
function call:

arch/x86/net/bpf_jit_comp.c:emit_kasan_check() {
    ...
	/* Save r8 */
	EMIT2(0x41, 0x50);
	/* Save r9 */
	EMIT2(0x41, 0x51);

	/* mov rdi, addr_reg */
    ...
}

For BPF_STX, if constant blinding is used, src_reg is BPF_REG_AX (r10).
The value in src_reg is corrupted by emit_kasan_check() before it is stored
by emit_stx():

arch/x86/net/bpf_jit_comp.c:do_jit() {
    ...
			err = emit_kasan_check(env, &prog, dst_reg, insn, ip,
					       true, accesses_stack_only);
			if (err)
				return err;
			emit_stx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn_off);
    ...
}

Additionally, in atomic fetch operations, BPF_REG_0 is moved into BPF_REG_AX.
The pointer (real_dst_reg) might become BPF_REG_AX, which is passed to
emit_kasan_check() and then used afterwards, resulting in using a corrupted
pointer:

arch/x86/net/bpf_jit_comp.c:do_jit() {
    ...
				/* Will need RAX as a CMPXCHG operand so save R0 */
				emit_mov_reg(&prog, true, BPF_REG_AX, BPF_REG_0);
				if (src_reg == BPF_REG_0)
					real_src_reg = BPF_REG_AX;
				if (dst_reg == BPF_REG_0)
					real_dst_reg = BPF_REG_AX;

				ip += 3;
			}
			if (!bpf_atomic_is_load_store(insn)) {
				err = emit_kasan_check(env, &prog, real_dst_reg,
						       insn, ip, false,
						       accesses_stack_only);
    ...
}

Unprivileged users loading BPF programs with constant blinding might trigger
arbitrary memory reads or writes due to this clobbering.

>  	select HAVE_EFFICIENT_UNALIGNED_ACCESS
>  	select HAVE_EISA			if X86_32
>  	select HAVE_EXIT_THREAD

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-kasan-v4-0-d5c177ab8227@bootlin.com?part=7