linux-kernel - Re: [syzbot] Re: [syzbot] [bpf?] KMSAN: uninit-value in htab_lru_percpu_map_lookup_percpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0000000000005cba90061ac5e91a@google.com>
Date: Thu, 13 Jun 2024 06:59:46 -0700
From: syzbot <syzbot+1971e47e5210c718db3c@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] Re: [syzbot] [bpf?] KMSAN: uninit-value in htab_lru_percpu_map_lookup_percpu_elem

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: Re: [syzbot] [bpf?] KMSAN: uninit-value in htab_lru_percpu_map_lookup_percpu_elem
Author: wojciech.gladysz@...ogain.com

#syz test: https://linux.googlesource.com/linux/kernel/git/torvalds/linux e478cf26c556e4ab572ab0ab2306c986901dcd61

--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -139,7 +139,7 @@ const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto = {
        .pkt_access     = true,
        .ret_type       = RET_PTR_TO_MAP_VALUE_OR_NULL,
        .arg1_type      = ARG_CONST_MAP_PTR,
-       .arg2_type      = ARG_PTR_TO_MAP_KEY,
+       .arg2_type      = ARG_PTR_TO_MAP_KEY | MEM_RDONLY,
        .arg3_type      = ARG_ANYTHING,
 };

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7146,8 +7146,8 @@ static int check_stack_range_initialized(
                 * reads. However, if raw_mode is not set, we'll do extra
                 * checks below.
                 */
-               bounds_check_type = BPF_WRITE;
-               clobber = true;
+               clobber = !meta || meta->raw_mode;
+               bounds_check_type = clobber ? BPF_WRITE : BPF_READ;
        } else {
                bounds_check_type = BPF_READ;
        }
@@ -7230,8 +7230,7 @@ static int check_stack_range_initialized(
                stype = &state->stack[spi].slot_type[slot % BPF_REG_SIZE];
                if (*stype == STACK_MISC)
                        goto mark;
-               if ((*stype == STACK_ZERO) ||
-                   (*stype == STACK_INVALID && env->allow_uninit_stack)) {
+               if (*stype == STACK_ZERO) {
                        if (clobber) {
                                /* helper can write anything into the stack */
                                *stype = STACK_MISC;
@@ -8748,6 +8747,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
                meta->map_uid = reg->map_uid;
                break;
        case ARG_PTR_TO_MAP_KEY:
+               meta->raw_mode = !(arg_type & MEM_RDONLY); // read only fo const* pointer
                /* bpf_map_xxx(..., map_ptr, ..., key) call:
                 * check that [key, key + map->key_size) are within
                 * stack limits and initialized
@@ -8763,7 +8763,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
                }
                err = check_helper_mem_access(env, regno,
                                              meta->map_ptr->key_size, false,
-                                             NULL);
+                                             meta);
                break;
        case ARG_PTR_TO_MAP_VALUE:
                if (type_may_be_null(arg_type) && register_is_null(reg))
--
2.35.3
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to it by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken based on it, is strictly prohibited and may be unlawful.