Received-SPF: pass (google.com: domain of linux-kernel+bounces-213387-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Precedence: bulk
MIME-Version: 1.0
Date: Thu, 13 Jun 2024 06:59:46 -0700
In-Reply-To: <0000000000008312ad06163b7225@google.com>
Message-ID: <0000000000005cba90061ac5e91a@google.com>
Subject: Re: [syzbot] Re: [syzbot] [bpf?] KMSAN: uninit-value in htab_lru_percpu_map_lookup_percpu_elem
From: syzbot <syzbot+1971e47e5210c718db3c@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [bpf?] KMSAN: uninit-value in htab_lru_percpu_map_loo=
kup_percpu_elem
Author: wojciech.gladysz@infogain.com

#syz test: https://linux.googlesource.com/linux/kernel/git/torvalds/linux e=
478cf26c556e4ab572ab0ab2306c986901dcd61

--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -139,7 +139,7 @@ const struct bpf_func_proto bpf_map_lookup_percpu_elem_=
proto =3D {
        .pkt_access     =3D true,
        .ret_type       =3D RET_PTR_TO_MAP_VALUE_OR_NULL,
        .arg1_type      =3D ARG_CONST_MAP_PTR,
-       .arg2_type      =3D ARG_PTR_TO_MAP_KEY,
+       .arg2_type      =3D ARG_PTR_TO_MAP_KEY | MEM_RDONLY,
        .arg3_type      =3D ARG_ANYTHING,
 };

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7146,8 +7146,8 @@ static int check_stack_range_initialized(
                 * reads. However, if raw_mode is not set, we'll do extra
                 * checks below.
                 */
-               bounds_check_type =3D BPF_WRITE;
-               clobber =3D true;
+               clobber =3D !meta || meta->raw_mode;
+               bounds_check_type =3D clobber ? BPF_WRITE : BPF_READ;
        } else {
                bounds_check_type =3D BPF_READ;
        }
@@ -7230,8 +7230,7 @@ static int check_stack_range_initialized(
                stype =3D &state->stack[spi].slot_type[slot % BPF_REG_SIZE]=
;
                if (*stype =3D=3D STACK_MISC)
                        goto mark;
-               if ((*stype =3D=3D STACK_ZERO) ||
-                   (*stype =3D=3D STACK_INVALID && env->allow_uninit_stack=
)) {
+               if (*stype =3D=3D STACK_ZERO) {
                        if (clobber) {
                                /* helper can write anything into the stack=
 */
                                *stype =3D STACK_MISC;
@@ -8748,6 +8747,7 @@ static int check_func_arg(struct bpf_verifier_env *en=
v, u32 arg,
                meta->map_uid =3D reg->map_uid;
                break;
        case ARG_PTR_TO_MAP_KEY:
+               meta->raw_mode =3D !(arg_type & MEM_RDONLY); // read only f=
o const* pointer
                /* bpf_map_xxx(..., map_ptr, ..., key) call:
                 * check that [key, key + map->key_size) are within
                 * stack limits and initialized
@@ -8763,7 +8763,7 @@ static int check_func_arg(struct bpf_verifier_env *en=
v, u32 arg,
                }
                err =3D check_helper_mem_access(env, regno,
                                              meta->map_ptr->key_size, fals=
e,
-                                             NULL);
+                                             meta);
                break;
        case ARG_PTR_TO_MAP_VALUE:
                if (type_may_be_null(arg_type) && register_is_null(reg))
--
2.35.3
The information in this email is confidential and may be legally privileged=
. It is intended solely for the addressee and access to it by anyone else i=
s unauthorized. If you are not the intended recipient, any disclosure, copy=
ing, distribution or any action taken or omitted to be taken based on it, i=
s strictly prohibited and may be unlawful.