Re: [PATCH 6.6.y 2/2] bpf: Invalidate dynptr clones in every call frame on release

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Dynptr slices belonging to a cross-frame clone are not invalidated if the subprogram containing the clone returns before the original dynptr is released, leading to a Use-After-Free on ringbuf memory.
--

commit f98ee666f54971a2824f38f254185708f60a777a
Author: Amery Hung <ameryhung@gmail.com>
Date:   Sat Aug 29 03:37:01 2026 +0000

    bpf: Invalidate dynptr clones in every call frame on release

This commit modifies unmark_stack_slots_dynptr to iterate over all active
call frames rather than just the current frame when invalidating dynptr clones.
It also adds a cross-frame clone regression test.

Link: https://lore.kernel.org/r/20260529014936.2811085-6-ameryhung@gmail.com

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 62fa2895a9205..fa88e7a35f901 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -1026,22 +1026,31 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re
>  	WARN_ON_ONCE(release_reference(env, ref_obj_id));
>  	invalidate_slices_of_dynptr(env, state->stack[spi].spilled_ptr.id);
>  
> -	/* Invalidate any dynptr clones */
> -	for (i = 1; i < state->allocated_stack / BPF_REG_SIZE; i++) {
> -		if (state->stack[i].spilled_ptr.ref_obj_id != ref_obj_id)
> +	/* Invalidate any dynptr clones, including those in other frames.
> +	 * Do not turn a failing release_reference() into -EINVAL: that
> +	 * rejects legitimate cross-frame single releases on 6.6/6.12/6.13.
> +	 */
> +	for (frm = 0; frm <= env->cur_state->curframe; frm++) {

[Severity: Critical]
This isn't a bug introduced by this patch, but does this loop restriction fail
to invalidate slices belonging to clones in frames that have already returned?

If a subprogram (Frame 1) clones a ringbuf dynptr, the clone receives a unique
clone->id but shares the original ref_obj_id X. If Frame 1 then creates a slice
from this clone via bpf_dynptr_slice_rdwr, the slice sets dynptr_id = clone->id
but leaves ref_obj_id = 0.

If Frame 1 spills this slice pointer to the caller's (Frame 0) stack and
returns, the clone goes out of scope without an explicit release. When Frame 0
later releases the original dynptr:

release_reference(X) executes, but does not clear the spilled slice because the
slice's ref_obj_id is 0. 

unmark_stack_slots_dynptr then executes, but since the subprogram returned,
curframe is 0. The loop only checks Frame 0 and fails to find the clone because
Frame 1's stack is already gone.

Since it never discovers clone->id, invalidate_slices_of_dynptr(clone->id) is
never called. Does this leave the spilled slice on Frame 0's stack fully valid,
allowing an unprivileged BPF program to read or write freed ringbuf memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260829032754.2324760-1-xyx2021@mail.ustc.edu.cn?part=2