[STABLE REQUEST] bpf: backport de36adca6346 to 7.1.y

[STABLE REQUEST] bpf: backport de36adca6346 to 7.1.y

[하태구]

Hello,

Please consider backporting the following upstream commit to Linux 7.1.y:

de36adca634634c205a9eb8b56a28175ab7abf5f
("bpf: reject overlarge global subprog argument sizes")

The issue was introduced by:

2cb27158adb3 ("bpf: poison dead stack slots")

which is present in Linux 7.1.

The fix rejects BTF-derived global subprogram argument sizes larger
than S32_MAX. Without the check, the caller-side PTR_TO_STACK
validation can interpret an overlarge size differently from the
callee-side PTR_TO_MEM state, potentially allowing the verifier to
validate accesses outside the actual stack object.

The upstream commit includes a selftest and applies cleanly to the
current linux-7.1.y tree. The fix is present in Linux 7.2 but is not
present in Linux 7.1.10 or the current 7.1 stable queue.

Upstream commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=de36adca634634c205a9eb8b56a28175ab7abf5f

Target stable series:

7.1.y

Thank you,
Taegu Ha

Re: [STABLE REQUEST] bpf: backport de36adca6346 to 7.1.y

[Greg KH]

On Tue, Aug 25, 2026 at 04:00:34AM +0900, 하태구 wrote:
> Hello,
> 
> Please consider backporting the following upstream commit to Linux 7.1.y:
> 
> de36adca634634c205a9eb8b56a28175ab7abf5f
> ("bpf: reject overlarge global subprog argument sizes")
> 
> The issue was introduced by:
> 
> 2cb27158adb3 ("bpf: poison dead stack slots")
> 
> which is present in Linux 7.1.
> 
> The fix rejects BTF-derived global subprogram argument sizes larger
> than S32_MAX. Without the check, the caller-side PTR_TO_STACK
> validation can interpret an overlarge size differently from the
> callee-side PTR_TO_MEM state, potentially allowing the verifier to
> validate accesses outside the actual stack object.
> 
> The upstream commit includes a selftest and applies cleanly to the
> current linux-7.1.y tree. The fix is present in Linux 7.2 but is not
> present in Linux 7.1.10 or the current 7.1 stable queue.
> 
> Upstream commit:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=de36adca634634c205a9eb8b56a28175ab7abf5f
> 
> Target stable series:
> 
> 7.1.y

It does not actually build properly, how did you test this?  Please
provide a working backport that has been tested if you wish to see this
added to the 7.1.y tree.

thanks,

greg k-h

[PATCH 7.1.y] bpf: reject overlarge global subprog argument sizes

[Taegu Ha]

[ Upstream commit de36adca634634c205a9eb8b56a28175ab7abf5f ]

Global subprogram argument checking derives generic pointer sizes from BTF
and passes the resolved size to check_mem_reg() as a u32. The access-size
validation path then uses a signed int, and stack pointers negate the value
before calling check_helper_mem_access().

This creates a wrap when BTF describes a pointee size larger than S32_MAX.
For example, a global subprogram argument of type:

  int (*p)[0x3fffffff]

has a BTF-resolved pointee size of 0xfffffffc bytes. At a call site the
caller can pass a pointer to a 4-byte stack slot at fp-4. The current
PTR_TO_STACK path computes:

  size = -(int)mem_size

so 0xfffffffc becomes -4 as a signed int and the negation validates only
a 4-byte stack range. That range is covered by the caller's stack slot,
so the call is accepted.

The callee is then verified independently with R1 as PTR_TO_MEM and
mem_size 0xfffffffc. A small instruction such as:

  r0 = *(u32 *)(r1 + 4)

is accepted as being inside that BTF-described memory region. At run time,
however, the actual argument value is still fp-4, so r1 + 4 addresses fp+0,
outside the 4-byte object that the caller provided.

Reject sizes that cannot be represented by the verifier's signed
access-size API before the stack-specific negation. Add a verifier
regression test for the oversized BTF argument.

[ taegu: Backport to 7.1.y: check_mem_reg() still takes a register number
  and reg_arg_name() is not available. Emit the equivalent R%d diagnostic
  using regno. The patched v7.1.10 kernel builds and the targeted
  verifier_global_subprogs/anon_user_mem_huge_size_invalid selftest passes
  after booting the kernel on x86_64 under QEMU. ]

Fixes: 2cb27158adb3 ("bpf: poison dead stack slots")
Signed-off-by: Taegu Ha <hataegu0826@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260528062155.3988156-1-hataegu0826@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
 kernel/bpf/verifier.c                           |  6 ++++++
 .../bpf/progs/verifier_global_subprogs.c        | 17 +++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5bad71f..c4173bf 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7119,6 +7119,12 @@ static int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg
 	if (bpf_register_is_null(reg))
 		return 0;
 
+	if (mem_size > S32_MAX) {
+		verbose(env, "R%d memory size %u is too large\n",
+			regno, mem_size);
+		return -EACCES;
+	}
+
 	/* Assuming that the register contains a value check if the memory
 	 * access is safe. Temporarily save and restore the register's state as
 	 * the conversion shouldn't be visible to a caller.
diff --git a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
index 1e08aff..0ff8f85 100644
--- a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
+++ b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
@@ -151,6 +151,23 @@ int anon_user_mem_valid(void *ctx)
 	return subprog_user_anon_mem(&t);
 }
 
+__noinline __weak int subprog_user_anon_mem_huge(int (*p)[0x3fffffff])
+{
+	return p ? (*p)[1] : 0;
+}
+
+SEC("?tracepoint")
+__failure __log_level(2)
+__msg("R1 memory size 4294967292 is too large")
+int anon_user_mem_huge_size_invalid(void *ctx)
+{
+	int (*p)[0x3fffffff];
+	int tiny = 42;
+
+	p = (void *)&tiny;
+	return subprog_user_anon_mem_huge(p) + tiny;
+}
+
 __noinline __weak int subprog_nonnull_ptr_good(int *p1 __arg_nonnull, int *p2 __arg_nonnull)
 {
 	return (*p1) * (*p2); /* good, no need for NULL checks */
-- 
2.43.0

Re: [PATCH 7.1.y] bpf: reject overlarge global subprog argument sizes

[Sasha Levin]

> [ Upstream commit de36adca634634c205a9eb8b56a28175ab7abf5f ]
>
> Global subprogram argument checking derives generic pointer sizes from BTF
> and passes the resolved size to check_mem_reg() as a u32. The access-size
> validation path then uses a signed int, and stack pointers negate the value
> before calling check_helper_mem_access().

Queued for 7.1, thanks.

-- 
Thanks,
Sasha