Re: [PATCH bpf-next 21/26] bpf: Stop assigning ids to scalars

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] bpf: missing arena pointer scalar check in
  adjust_reg_min_max_vals() [1]
--

commit 3c630c864568ebd00223455e2f9580fa8ae14a89
Author: Alexei Starovoitov <ast@kernel.org>

bpf: Stop assigning ids to scalars

This commit stops assigning and maintaining IDs and constant deltas on
scalar registers and stack slots in the BPF verifier, as scalar evolution
and flow joining now handle linked-register refinement and copy detection.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 103e83cd23ef0..3d1be990123ba 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -18226,10 +18150,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
>  	struct bpf_func_state *state = vstate->frame[vstate->curframe];
>  	struct bpf_reg_state *regs = state->regs, *dst_reg, *src_reg;
>  	struct bpf_reg_state *ptr_reg = NULL, off_reg = {0};
> -	bool alu32 = (BPF_CLASS(insn->code) != BPF_ALU64);
>  	struct bpf_insn_aux_data *aux = cur_aux(env);
>  	u8 opcode = BPF_OP(insn->code);
> -	int err;
>  
>  	dst_reg = &regs[insn->dst_reg];
>  	if (BPF_SRC(insn->code) == BPF_X)

[Severity: Critical]
This problem wasn't introduced by this patch, but can the PTR_TO_ARENA
fast-path in adjust_reg_min_max_vals() allow pointer-to-pointer arithmetic
and leak kernel addresses [1]?

kernel/bpf/verifier.c:adjust_reg_min_max_vals() {
	...
	/* Case where at least one operand is an arena. */
	if (dst_reg->type == PTR_TO_ARENA || (src_reg && src_reg->type == PTR_TO_ARENA)) {
		...
		if (dst_reg->type != PTR_TO_ARENA)
			*dst_reg = *src_reg;
		...
		/* Any arithmetic operations are allowed on arena pointers */
		return 0;
	}
}

When one operand is PTR_TO_ARENA and the other is a kernel pointer such as
PTR_TO_MAP_VALUE, this block overwrites dst_reg's state with the
PTR_TO_ARENA state and returns 0 before reaching the pointer-to-pointer
checks below.  A program can then use addr_space_cast on the resulting
PTR_TO_ARENA register to turn the truncated 32-bit kernel pointer value
into a scalar, bypassing !env->allow_ptr_leaks.

[1] https://sashiko.dev/#/bug/linux-d1a28821-a6c7-4535-946a-d82f1ba22e63

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109064715.2382452-1-alexei.starovoitov@gmail.com?part=21