Re: [syzbot] Re: [syzbot] [bpf?] KMSAN: uninit-value in htab_lru_percpu_map_lookup_percpu_elem

[syzbot <syzbot+1971e47e5210c718db3c@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [bpf?] KMSAN: uninit-value in htab_lru_percpu_map_lookup_percpu_elem
Author: wojciech.gladysz@infogain.com

#syz test: https://linux.googlesource.com/linux/kernel/git/torvalds/linux e478cf26c556e4ab572ab0ab2306c986901dcd61

--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -139,7 +139,7 @@ const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto = {
        .pkt_access     = true,
        .ret_type       = RET_PTR_TO_MAP_VALUE_OR_NULL,
        .arg1_type      = ARG_CONST_MAP_PTR,
-       .arg2_type      = ARG_PTR_TO_MAP_KEY,
+       .arg2_type      = ARG_PTR_TO_MAP_KEY | MEM_RDONLY,
        .arg3_type      = ARG_ANYTHING,
 };

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7146,8 +7146,8 @@ static int check_stack_range_initialized(
                 * reads. However, if raw_mode is not set, we'll do extra
                 * checks below.
                 */
-               bounds_check_type = BPF_WRITE;
-               clobber = true;
+               clobber = !meta || meta->raw_mode;
+               bounds_check_type = clobber ? BPF_WRITE : BPF_READ;
        } else {
                bounds_check_type = BPF_READ;
        }
@@ -7230,8 +7230,7 @@ static int check_stack_range_initialized(
                stype = &state->stack[spi].slot_type[slot % BPF_REG_SIZE];
                if (*stype == STACK_MISC)
                        goto mark;
-               if ((*stype == STACK_ZERO) ||
-                   (*stype == STACK_INVALID && env->allow_uninit_stack)) {
+               if (*stype == STACK_ZERO) {
                        if (clobber) {
                                /* helper can write anything into the stack */
                                *stype = STACK_MISC;
@@ -8748,6 +8747,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
                meta->map_uid = reg->map_uid;
                break;
        case ARG_PTR_TO_MAP_KEY:
+               meta->raw_mode = !(arg_type & MEM_RDONLY); // read only fo const* pointer
                /* bpf_map_xxx(..., map_ptr, ..., key) call:
                 * check that [key, key + map->key_size) are within
                 * stack limits and initialized
@@ -8763,7 +8763,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
                }
                err = check_helper_mem_access(env, regno,
                                              meta->map_ptr->key_size, false,
-                                             NULL);
+                                             meta);
                break;
        case ARG_PTR_TO_MAP_VALUE:
                if (type_may_be_null(arg_type) && register_is_null(reg))
--
2.35.3
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to it by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken based on it, is strictly prohibited and may be unlawful.