[PATCH bpf-next 1/2] bpf: Drop scalar id on sign-extending narrowing stack fills

[PATCH bpf-next 1/2] bpf: Drop scalar id on sign-extending narrowing stack fills

[Daniel Borkmann]

When a spilled scalar is filled back with a sign-extending narrowing load
(BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register
including its scalar id, but coerce_reg_to_size_sx() then sign-extends the
filled register's value. If the same slot is also filled with a plain
zero-extending load (BPF_MEM), both destination registers share the id yet
hold different values. A later 'if <zext-reg> == const' then refines the
sign-extended register through sync_linked_regs() to a value it does not
have at runtime (e.g. the verifier believes 0x80000000 while the register
is 0xffffffff80000000), which can be turned into an out-of-bounds access.

Drop the shared scalar id at the sign-extension site in check_mem_access()
when sign extension actually changes the value, mirroring the BPF_MOVSX
handling in check_alu_op() (no_sext = reg_umax < 2^(size*8-1)).

Fixes: 3cd5c890652b ("bpf: Let the verifier assign ids on stack fills")
Reported-by: STAR Labs SG <info@starlabs.sg>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Puranjay Mohan <puranjay@kernel.org>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Yonghong Song <yonghong.song@linux.dev>
---
 kernel/bpf/verifier.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 233472a871be..a0830ad6bebb 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6394,11 +6394,23 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
 
 	if (!err && size < BPF_REG_SIZE && value_regno >= 0 && t == BPF_READ &&
 	    regs[value_regno].type == SCALAR_VALUE) {
-		if (!is_ldsx)
+		if (!is_ldsx) {
 			/* b/h/w load zero-extends, mark upper bits as known 0 */
 			coerce_reg_to_size(&regs[value_regno], size);
-		else
+		} else {
+			/*
+			 * Sign-extension can change the register value relative
+			 * to a scalar it is linked with by id (e.g. a zero-
+			 * extending fill of the same spilled stack slot), thus
+			 * drop the shared id in that case.
+			 */
+			bool no_sext = reg_umax(&regs[value_regno]) <
+					(1ULL << (size * BITS_PER_BYTE - 1));
+
 			coerce_reg_to_size_sx(&regs[value_regno], size);
+			if (!no_sext)
+				clear_scalar_id(&regs[value_regno]);
+		}
 	}
 	return err;
 }
-- 
2.43.0

[PATCH bpf-next 2/2] selftests/bpf: Add test for scalar id on sign-extending stack fill

[Daniel Borkmann]

Add a verifier test where a spilled scalar is filled once via a sign-
extending load (BPF_MEMSX) and once via a zero-extending load (BPF_MEM).
The two destination registers must not share a scalar id.

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_scalar_ids
  [...]
  #643/1   verifier_scalar_ids/linked_regs_bpf_k:OK
  #643/2   verifier_scalar_ids/linked_regs_bpf_x_src:OK
  #643/3   verifier_scalar_ids/linked_regs_bpf_x_dst:OK
  #643/4   verifier_scalar_ids/linked_regs_broken_link:OK
  #643/5   verifier_scalar_ids/precision_many_frames:OK
  #643/6   verifier_scalar_ids/precision_stack:OK
  #643/7   verifier_scalar_ids/precision_two_ids:OK
  #643/8   verifier_scalar_ids/linked_regs_too_many_regs:OK
  #643/9   verifier_scalar_ids/linked_regs_broken_link_2:OK
  #643/10  verifier_scalar_ids/cjmp_no_linked_regs_trigger:OK
  #643/11  verifier_scalar_ids/check_ids_in_regsafe:OK
  #643/12  verifier_scalar_ids/check_ids_in_regsafe_2:OK
  #643/13  verifier_scalar_ids/no_scalar_id_for_const:OK
  #643/14  verifier_scalar_ids/no_scalar_id_for_const32:OK
  #643/15  verifier_scalar_ids/ignore_unique_scalar_ids_cur:OK
  #643/16  verifier_scalar_ids/ignore_unique_scalar_ids_old:OK
  #643/17  verifier_scalar_ids/two_nil_old_ids_one_cur_id:OK
  #643/18  verifier_scalar_ids/two_old_ids_one_cur_id:OK
  #643/19  verifier_scalar_ids/linked_regs_and_subreg_def:OK
  #643/20  verifier_scalar_ids/ldsx_fill_scalar_id_not_shared:OK
  #643     verifier_scalar_ids:OK
  Summary: 1/20 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 .../selftests/bpf/progs/verifier_scalar_ids.c | 56 +++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
index e38f102da45f..663d15fc5fd2 100644
--- a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
+++ b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
@@ -4,6 +4,13 @@
 #include <bpf/bpf_helpers.h>
 #include "bpf_misc.h"
 
+struct {
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__uint(max_entries, 1);
+	__type(key, long long);
+	__type(value, long long);
+} map_hash_8b SEC(".maps");
+
 /* Check that precision marks propagate through scalar IDs.
  * Registers r{0,1,2} have the same scalar ID.
  * Range information is propagated for scalars sharing same ID.
@@ -915,4 +922,53 @@ __naked void linked_regs_and_subreg_def(void)
 	: __clobber_all);
 }
 
+/*
+ * A scalar is spilled to the stack and then filled twice: once via a
+ * sign-extending load (BPF_MEMSX) into r4 and once via a zero-extending
+ * load (BPF_MEM) into r5. coerce_reg_to_size_sx() gives r4 a different
+ * value than the spilled/zero-extended siblings, so r4 must not keep the
+ * shared scalar id. Otherwise the later 'if r5 == 0x80000000' refines r4
+ * through sync_linked_regs() to a known 0x80000000, while at runtime r4
+ * is the sign-extended 0xffffffff80000000. The test turns that discrepancy
+ * into an out-of-bounds map value access (r4 >> 63 is believed 0 but is 1
+ * at runtime), which must be rejected.
+ */
+SEC("socket")
+__failure __msg("R0 max value is outside of the allowed memory range")
+__naked void ldsx_fill_scalar_id_not_shared(void)
+{
+	asm volatile ("					\
+	r1 = 0;						\
+	*(u64*)(r10 - 8) = r1;				\
+	r2 = r10;					\
+	r2 += -8;					\
+	r1 = %[map_hash_8b] ll;				\
+	call %[bpf_map_lookup_elem];			\
+	if r0 == 0 goto l0_%=;				\
+	/* r7 = unknown u32, keep only bit 31 */	\
+	r7 = *(u32*)(r0 + 0);				\
+	r2 = 0x80000000 ll;				\
+	r7 &= r2;					\
+	/* link r6 and r7 via a fresh scalar id */	\
+	r6 = r7;					\
+	/* spill r7 (u32) to the stack */		\
+	*(u32*)(r10 - 8) = r7;				\
+	/* sign-extending fill: must drop the id */	\
+	r4 = *(s32*)(r10 - 8);				\
+	/* zero-extending fill: keeps the id */		\
+	r5 = *(u32*)(r10 - 8);				\
+	/* r5 becomes known 0x80000000 on fall-through */\
+	if r5 != r2 goto l0_%=;				\
+	/* verifier believes r4 == 0 here, runtime is 1 */\
+	r4 >>= 63;					\
+	r0 += r4;					\
+	r0 = *(u8*)(r0 + 7);				\
+l0_%=:	r0 = 0;						\
+	exit;						\
+"	:
+	: __imm(bpf_map_lookup_elem),
+	  __imm_addr(map_hash_8b)
+	: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";
-- 
2.43.0

Re: [PATCH bpf-next 1/2] bpf: Drop scalar id on sign-extending narrowing stack fills

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Eduard Zingerman <eddyz87@gmail.com>:

On Thu,  9 Jul 2026 17:31:30 +0200 you wrote:
> When a spilled scalar is filled back with a sign-extending narrowing load
> (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register
> including its scalar id, but coerce_reg_to_size_sx() then sign-extends the
> filled register's value. If the same slot is also filled with a plain
> zero-extending load (BPF_MEM), both destination registers share the id yet
> hold different values. A later 'if <zext-reg> == const' then refines the
> sign-extended register through sync_linked_regs() to a value it does not
> have at runtime (e.g. the verifier believes 0x80000000 while the register
> is 0xffffffff80000000), which can be turned into an out-of-bounds access.
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] bpf: Drop scalar id on sign-extending narrowing stack fills
    https://git.kernel.org/bpf/bpf-next/c/2cb5f4ca695e
  - [bpf-next,2/2] selftests/bpf: Add test for scalar id on sign-extending stack fill
    https://git.kernel.org/bpf/bpf-next/c/c3d5ef291a2a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html