* [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores
@ 2026-03-06 9:03 CyFun
2026-03-09 16:21 ` Emil Tsalapatis
2026-03-09 16:41 ` Puranjay Mohan
0 siblings, 2 replies; 3+ messages in thread
From: CyFun @ 2026-03-06 9:03 UTC (permalink / raw)
To: bpf@vger.kernel.org
Cc: daniel@iogearbox.net, ast@kernel.org, andrii@kernel.org,
netdev@vger.kernel.org
[-- Attachment #1.1: Type: text/plain, Size: 2733 bytes --]
To: bpf@vger.kernel.org
Cc: daniel@iogearbox.net, ast@kernel.org, andrii@kernel.org, netdev@vger.kernel.org
Subject: [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
before bpf_jit_blind_constants() runs during JIT compilation. The
blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
unblinded.
Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the
existing BPF_ST|BPF_MEM cases. The blinding transformation is identical:
load the blinded immediate into BPF_REG_AX via mov+xor, then convert
the immediate store to a register store (BPF_STX).
The rewritten STX instruction must preserve the BPF_PROBE_MEM32 mode so
the architecture JIT emits the correct arena addressing (R12-based on
x86-64). Cannot use the BPF_STX_MEM() macro here because it hardcodes
BPF_MEM mode; construct the instruction directly instead.
Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
Signed-off-by: s4ch <xcyfun@protonmail.com>
---
v2: Rebased onto current bpf tree (commit 56145d237385).
v1 had a malformed diff header that caused CI to reject it.
---
kernel/bpf/core.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 3ece2da55..bb2fa75de 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1422,6 +1422,24 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from,
*to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
*to++ = BPF_STX_MEM(from->code, from->dst_reg, BPF_REG_AX, from->off);
break;
+
+ case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
+ case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
+ case BPF_ST | BPF_PROBE_MEM32 | BPF_H:
+ case BPF_ST | BPF_PROBE_MEM32 | BPF_B:
+ *to++ = BPF_ALU64_IMM(BPF_MOV, BPF_REG_AX, imm_rnd ^
+ from->imm);
+ *to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
+ /* Cannot use BPF_STX_MEM() here: it hardcodes BPF_MEM
+ * mode which would lose BPF_PROBE_MEM32 and break the
+ * arena addressing in the architecture JIT. */
+ *to++ = (struct bpf_insn) {
+ .code = BPF_STX | BPF_PROBE_MEM32 | BPF_SIZE(from->code),
+ .dst_reg = from->dst_reg,
+ .src_reg = BPF_REG_AX,
+ .off = from->off,
+ };
+ break;
}
out:
return to - to_buff;
--
2.53.0
[-- Attachment #1.2: publickey - xcyfun@protonmail.com - 0x33596AE7.asc --]
[-- Type: application/pgp-keys, Size: 653 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 343 bytes --]
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores
2026-03-06 9:03 [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores CyFun
@ 2026-03-09 16:21 ` Emil Tsalapatis
2026-03-09 16:41 ` Puranjay Mohan
1 sibling, 0 replies; 3+ messages in thread
From: Emil Tsalapatis @ 2026-03-09 16:21 UTC (permalink / raw)
To: CyFun, bpf@vger.kernel.org
Cc: daniel@iogearbox.net, ast@kernel.org, andrii@kernel.org,
netdev@vger.kernel.org
On Fri Mar 6, 2026 at 4:03 AM EST, CyFun wrote:
> To: bpf@vger.kernel.org
> Cc: daniel@iogearbox.net, ast@kernel.org, andrii@kernel.org, netdev@vger.kernel.org
> Subject: [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores
>
> BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
> bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
> survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
>
> The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
> to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
> before bpf_jit_blind_constants() runs during JIT compilation. The
> blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
> BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
> unblinded.
>
> Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the
> existing BPF_ST|BPF_MEM cases. The blinding transformation is identical:
> load the blinded immediate into BPF_REG_AX via mov+xor, then convert
> the immediate store to a register store (BPF_STX).
>
> The rewritten STX instruction must preserve the BPF_PROBE_MEM32 mode so
> the architecture JIT emits the correct arena addressing (R12-based on
> x86-64). Cannot use the BPF_STX_MEM() macro here because it hardcodes
> BPF_MEM mode; construct the instruction directly instead.
>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Though:
> Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
> Signed-off-by: s4ch <xcyfun@protonmail.com>
IIRC pseudonyms are not allowed on the SOB line so you will probably have to update it.
> ---
> v2: Rebased onto current bpf tree (commit 56145d237385).
> v1 had a malformed diff header that caused CI to reject it.
> ---
> kernel/bpf/core.c | 18 ++++++++++++++++++
> 1 file changed, 18 insertions(+)
>
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 3ece2da55..bb2fa75de 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -1422,6 +1422,24 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from,
> *to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
> *to++ = BPF_STX_MEM(from->code, from->dst_reg, BPF_REG_AX, from->off);
> break;
> +
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_H:
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_B:
> + *to++ = BPF_ALU64_IMM(BPF_MOV, BPF_REG_AX, imm_rnd ^
> + from->imm);
> + *to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
> + /* Cannot use BPF_STX_MEM() here: it hardcodes BPF_MEM
> + * mode which would lose BPF_PROBE_MEM32 and break the
> + * arena addressing in the architecture JIT. */
> + *to++ = (struct bpf_insn) {
> + .code = BPF_STX | BPF_PROBE_MEM32 | BPF_SIZE(from->code),
> + .dst_reg = from->dst_reg,
> + .src_reg = BPF_REG_AX,
> + .off = from->off,
> + };
> + break;
> }
> out:
> return to - to_buff;
> --
> 2.53.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores
2026-03-06 9:03 [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores CyFun
2026-03-09 16:21 ` Emil Tsalapatis
@ 2026-03-09 16:41 ` Puranjay Mohan
1 sibling, 0 replies; 3+ messages in thread
From: Puranjay Mohan @ 2026-03-09 16:41 UTC (permalink / raw)
To: CyFun, bpf@vger.kernel.org
Cc: daniel@iogearbox.net, ast@kernel.org, andrii@kernel.org,
netdev@vger.kernel.org
CyFun <xcyfun@protonmail.com> writes:
> To: bpf@vger.kernel.org
> Cc: daniel@iogearbox.net, ast@kernel.org, andrii@kernel.org, netdev@vger.kernel.org
> Subject: [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores
>
> BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by
> bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to
> survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
>
> The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM
> to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification,
> before bpf_jit_blind_constants() runs during JIT compilation. The
> blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not
> BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through
> unblinded.
>
> Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the
> existing BPF_ST|BPF_MEM cases. The blinding transformation is identical:
> load the blinded immediate into BPF_REG_AX via mov+xor, then convert
> the immediate store to a register store (BPF_STX).
>
> The rewritten STX instruction must preserve the BPF_PROBE_MEM32 mode so
> the architecture JIT emits the correct arena addressing (R12-based on
> x86-64). Cannot use the BPF_STX_MEM() macro here because it hardcodes
> BPF_MEM mode; construct the instruction directly instead.
>
> Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
> Signed-off-by: s4ch <xcyfun@protonmail.com>
> ---
> v2: Rebased onto current bpf tree (commit 56145d237385).
> v1 had a malformed diff header that caused CI to reject it.
> ---
> kernel/bpf/core.c | 18 ++++++++++++++++++
> 1 file changed, 18 insertions(+)
>
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 3ece2da55..bb2fa75de 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -1422,6 +1422,24 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from,
> *to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
> *to++ = BPF_STX_MEM(from->code, from->dst_reg, BPF_REG_AX, from->off);
> break;
> +
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_H:
> + case BPF_ST | BPF_PROBE_MEM32 | BPF_B:
> + *to++ = BPF_ALU64_IMM(BPF_MOV, BPF_REG_AX, imm_rnd ^
> + from->imm);
> + *to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
> + /* Cannot use BPF_STX_MEM() here: it hardcodes BPF_MEM
> + * mode which would lose BPF_PROBE_MEM32 and break the
> + * arena addressing in the architecture JIT. */
> + *to++ = (struct bpf_insn) {
> + .code = BPF_STX | BPF_PROBE_MEM32 | BPF_SIZE(from->code),
> + .dst_reg = from->dst_reg,
> + .src_reg = BPF_REG_AX,
> + .off = from->off,
> + };
> + break;
> }
> out:
> return to - to_buff;
> --
> 2.53.0
Reviewed-by: Puranjay Mohan <puranjay@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-09 16:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-06 9:03 [PATCH bpf v2] bpf: fix constant blinding bypass for PROBE_MEM32 stores CyFun
2026-03-09 16:21 ` Emil Tsalapatis
2026-03-09 16:41 ` Puranjay Mohan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox