Global subprogram argument checking derives generic pointer sizes from BTF and passes the resolved size to check_mem_reg() as a u32. The access-size validation path then uses a signed int, and stack pointers negate the value before calling check_helper_mem_access(). A BTF type such as int[0x3fffffff] resolves to 0xfffffffc bytes. On a stack pointer, (int)mem_size becomes -4 and the negation validates only four bytes. A caller can therefore pass a four-byte stack slot while the callee is verified with a nearly 4GiB memory argument, allowing accesses outside the caller object. This was confirmed with a non-executing raw-BTF reproducer. On a vulnerable kernel, the verifier accepted a program where the caller passed a four-byte stack slot, while the callee argument was described by BTF as int[0x3fffffff]. The verifier log showed: R1=mem_or_null(id=1,sz=0xfffffffc) r0 = *(u32 *)(r1 +4) The program was only loaded to prove verifier acceptance and was not attached or executed. Reject sizes that cannot be represented by the signed verifier access-size API before any conversion. Cast the non-stack case after the bound check to make the conversion explicit, and add a verifier regression test for the oversized BTF argument. Fixes: 2cb27158adb3 ("bpf: poison dead stack slots") Signed-off-by: Taegu Ha --- kernel/bpf/verifier.c | 7 ++++++- .../bpf/progs/verifier_global_subprogs.c | 17 +++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 7fb88e1cd7c4..1007f204a1f5 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -7107,6 +7107,11 @@ static int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg struct bpf_reg_state saved_reg; int err; + if (mem_size > S32_MAX) { + verbose(env, "R%d memory size %u is too large\n", regno, mem_size); + return -EACCES; + } + if (bpf_register_is_null(reg)) return 0; @@ -7119,7 +7124,7 @@ static int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg mark_ptr_not_null_reg(reg); } - int size = base_type(reg->type) == PTR_TO_STACK ? -(int)mem_size : mem_size; + int size = base_type(reg->type) == PTR_TO_STACK ? -(int)mem_size : (int)mem_size; err = check_helper_mem_access(env, regno, size, BPF_READ, true, NULL); err = err ?: check_helper_mem_access(env, regno, size, BPF_WRITE, true, NULL); diff --git a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c index 1e08aff7532e..0ff8f85b4d46 100644 --- a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c +++ b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c @@ -151,6 +151,23 @@ int anon_user_mem_valid(void *ctx) return subprog_user_anon_mem(&t); } +__noinline __weak int subprog_user_anon_mem_huge(int (*p)[0x3fffffff]) +{ + return p ? (*p)[1] : 0; +} + +SEC("?tracepoint") +__failure __log_level(2) +__msg("R1 memory size 4294967292 is too large") +int anon_user_mem_huge_size_invalid(void *ctx) +{ + int (*p)[0x3fffffff]; + int tiny = 42; + + p = (void *)&tiny; + return subprog_user_anon_mem_huge(p) + tiny; +} + __noinline __weak int subprog_nonnull_ptr_good(int *p1 __arg_nonnull, int *p2 __arg_nonnull) { return (*p1) * (*p2); /* good, no need for NULL checks */ -- 2.43.0