linux-kernel - Re: [PATCH bpf-next v3 03/13] bpf: Verifier support for KF_IMPLICIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQKtN9HS7sWE_fZex4hT=ZEGDQX+C7tS6jc2+8ixC+Jexw@mail.gmail.com>
Date: Tue, 20 Jan 2026 16:30:36 -0800
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Ihor Solodrai <ihor.solodrai@...ux.dev>
Cc: Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, 
	Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau <martin.lau@...ux.dev>, 
	Eduard Zingerman <eddyz87@...il.com>, Mykyta Yatsenko <yatsenko@...a.com>, Tejun Heo <tj@...nel.org>, 
	Alan Maguire <alan.maguire@...cle.com>, Benjamin Tissoires <bentiss@...nel.org>, 
	Jiri Kosina <jikos@...nel.org>, Amery Hung <ameryhung@...il.com>, bpf <bpf@...r.kernel.org>, 
	LKML <linux-kernel@...r.kernel.org>, 
	"open list:HID CORE LAYER" <linux-input@...r.kernel.org>, sched-ext@...ts.linux.dev
Subject: Re: [PATCH bpf-next v3 03/13] bpf: Verifier support for KF_IMPLICIT_ARGS

On Tue, Jan 20, 2026 at 2:27 PM Ihor Solodrai <ihor.solodrai@...ux.dev> wrote:
>
> Introduction of KF_IMPLICIT_ARGS revealed an issue with zero-extension
> tracking, because an explicit rX = 0 in place of the verifier-supplied
> argument is now absent if the arg is implicit (the BPF prog doesn't
> pass a dummy NULL anymore). To mitigate this, reset the subreg_def of
> all caller saved registers in check_kfunc_call() [1].
>
> [1] https://lore.kernel.org/bpf/b4a760ef828d40dac7ea6074d39452bb0dc82caa.camel@gmail.com/

...

> -       for (i = 0; i < CALLER_SAVED_REGS; i++)
> -               mark_reg_not_init(env, regs, caller_saved[i]);
> +       for (i = 0; i < CALLER_SAVED_REGS; i++) {
> +               u32 regno = caller_saved[i];
> +
> +               mark_reg_not_init(env, regs, regno);
> +               regs[regno].subreg_def = DEF_NOT_SUBREG;
> +       }

I'm reading that no follow up is necessary anymore and
the new selftests cover this part automatically.