[PATCH bpf-next v2 0/2] bpf: Validate byte type for helper stack reads

[Yiyang Chen]

The verifier checks helper memory arguments byte by byte, but its scalar
spill fast path only checks the slot-wide spill marker. For a CAP_BPF load,
a narrow scalar spill can therefore make an untouched sibling byte appear
initialized when the sibling is passed to a helper.

Patch 1 makes the fast path require STACK_SPILL for the byte being checked.
Patch 2 adds verifier_spill_fill coverage for a CAP_BPF map update helper
reading an invalid sibling byte.

Changes in v2:
- Rewrite the patch 1 commit message to explain the uninitialized-stack-read
  invariant and distinguish it from the pointer-leak check, with references
  to the related producer-side fix and direct-read selftest.
- Add the regression Fixes tag to patch 2 and use the neighboring inline-asm
  line-continuation style.

v1: https://lore.kernel.org/bpf/cover.1783920884.git.chenyy23@xxxxxxxxxxxxxxxxxxxxx/

Yiyang Chen (2):
  bpf: Check byte type when validating helper stack reads
  selftests/bpf: Cover helper reads of invalid spill siblings

 kernel/bpf/verifier.c                         |  3 +-
 .../selftests/bpf/progs/verifier_spill_fill.c | 34 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)


base-commit: 1d91ea01185656ac3ee63c5f9f6f8bde3c746b3d
-- 
2.34.1