check_stack_range_initialized() takes the spilled register path when bpf_is_spilled_reg(ss) holds, which, however, only looks at the last byte of the slot. Hence, a partially spilled scalar (on the lower part) bypasses the check and the following loads: 0: (b7) r1 = 1 ; R1=1 1: (63) *(u32 *)(r10 -8) = r1 ; R1=1 R10=fp0 fp-8=????1 2: (18) r1 = 0x0 ; R1=map_ptr(map=rb,ks=0,vs=0) 4: (bf) r2 = r10 ; R2=fp0 R10=fp0 5: (07) r2 += -8 ; R2=fp-8 6: (b7) r3 = 8 ; R3=8 7: (b7) r4 = 0 ; R4=0 8: (85) call bpf_ringbuf_output#130 ... When executed, it dumps the uninit four bytes: RINGBUF: 01 00 00 00 ff ff ff ff This is the same root cause as the non-fetch atomic case fixed in commit 5a84b4424db8 ("bpf: Fix uninit read for non-fetch atomics on partially spilled slots"). Fix by only taking the spilled register path for the bytes marked STACK_SPILL, so the rest of the slot goes through the usual checks. Fixes: 354e8f1970f8 ("bpf: Support <8-byte scalar spill and refill") Suggested-by: Kumar Kartikeya Dwivedi Signed-off-by: Hao Sun --- kernel/bpf/verifier.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c495dc9070de..5c8626215ee6 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -7484,7 +7484,12 @@ static int check_stack_range_initialized( goto mark; } - if (bpf_is_spilled_reg(ss) && + /* + * Only the bytes marked STACK_SPILL hold the spilled register. + * The rest of a narrowly spilled slot keeps its previous type + * and must be initialized on its own. + */ + if (*stype == STACK_SPILL && (ss->spilled_ptr.type == SCALAR_VALUE || env->allow_ptr_leaks)) { if (clobber) { -- 2.34.1