Re: [PATCH bpf-next v9 8/8] selftests/bpf: add tests to validate KASAN on JIT programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Uninitialized stack variables in BPF programs cause the BPF verifier to reject the programs unless compiled with auto-initialization.
--

commit 90ac04f2b17e345bd3d2714823f9bf8e9abd88df
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

selftests/bpf: add tests to validate KASAN on JIT programs
    
Add a basic KASAN test runner that loads and test-run programs that can
trigger memory management bugs. The test captures kernel logs and ensure
that the expected KASAN splat is emitted by searching for the
corresponding first lines in the report.

> diff --git a/tools/testing/selftests/bpf/progs/kasan.c b/tools/testing/selftests/bpf/progs/kasan.c
> new file mode 100644
> index 0000000000000..fe8e0dd228a09
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/kasan.c
> @@ -0,0 +1,502 @@
[ ... ]
> +SEC("tcx/ingress")
> +int st_on_stack(struct __sk_buff *skb)
> +{
> +	struct kasan_test_val val;
> +
> +	bpf_kfunc_kasan_poison(&val, sizeof(struct kasan_test_val));

[Severity: Medium]
Does this code cause a BPF verifier rejection? The BPF verifier requires
stack memory to be initialized before it is read. By passing the pointer
to val to bpf_kfunc_kasan_poison() when val is uninitialized, the verifier
will reject the program unless the kfunc argument is annotated to allow
uninitialized memory (or the toolchain automatically initializes stack
variables).

This exact pattern appears in all the _on_stack tests in this file (such as
stx_on_stack, ldx_on_stack, simple_atomic_on_stack, etc.). Should val be
initialized (for example, struct kasan_test_val val = {};)?

[ ... ]
> +SEC("tcx/ingress")
> +int ldx_oob(struct __sk_buff *skb)
> +{
> +	struct bpf_testmod_oob *val;
> +	struct kasan_test_val volatile tmp;
> +
> +	val = bpf_testmod_oob_alloc();
> +	if (!val)
> +		return 0;
> +
> +	switch (access_size) {
> +	case 1:
> +		tmp.data_1 = (__u8)val->redzone_1;
> +		break;
> +	case 2:
> +		tmp.data_2 = (__u16)val->redzone_2;
> +		break;
> +	case 4:
> +		tmp.data_4 = (__u32)val->redzone_4;
> +		break;
> +	case 8:
> +		tmp.data_8 = (__u64)val->redzone_8;
> +		break;
> +	}
> +	bpf_testmod_oob_free(val);
> +	return tmp.data_1;
> +}

[Severity: Medium]
Can tmp.data_1 be returned uninitialized here? If access_size != 1,
tmp.data_1 is never written to during the switch statement, but it is read
on the return path. This will cause the BPF verifier to reject the program for
an invalid read from uninitialized stack memory.

Should tmp be initialized when declared?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903-kasan-v9-0-2407fe99255a@bootlin.com?part=8