From: Alexei Starovoitov Date: Sat, 6 Jun 2026 23:44:47 +0000 (-0700) Subject: Merge branch 'bpf-verifier-fix-ptr_to_flow_keys-constant-offset-oob' X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f6cd665c10f1577eca9eef643c9d10ec0435fd61;p=thirdparty%2Flinux.git Merge branch 'bpf-verifier-fix-ptr_to_flow_keys-constant-offset-oob' Nuoqi Gui says: ==================== bpf, verifier: fix PTR_TO_FLOW_KEYS constant-offset OOB A constant offset added to a PTR_TO_FLOW_KEYS register lands in reg->var_off, but check_flow_keys_access() bounds-checks only insn->off and never folds reg->var_off.value. A BPF_PROG_TYPE_FLOW_DISSECTOR program can therefore do "flow_keys += 0x1000; *(flow_keys + 0)" and have it accepted, then read/write kernel stack past struct bpf_flow_keys at runtime. Patch 1 folds reg->var_off.value into the offset (and rejects non-constant offsets), mirroring check_ctx_access(); patch 2 adds verifier selftests. This is a regression introduced in the 7.1 development cycle by commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers"), which moved the constant offset from reg->off (folded generically before 022ac0750883) into reg->var_off without updating the flow_keys path. No released kernel is affected: v7.0.x rejects the program above, and the bug reproduces only on v7.1-rc1..rc5, so no stable backport is needed. It was first reported privately to security@kernel.org; per their guidance it is handled in the open as a normal regression fix. Found by manual verifier audit and confirmed dynamically in a disposable QEMU/KVM guest: the load above is accepted, a runtime read leaked a kernel-stack pointer 0x1000 past bpf_flow_keys, and a runtime write of a marker faulted the guest in net_rx_action. An alternative -- forbidding pointer arithmetic on PTR_TO_FLOW_KEYS outright by dropping "if (known) break;" in adjust_ptr_min_max_vals() -- was rejected because v7.0.x accepted (and correctly bounds-checked) constant arithmetic on the keys pointer; restoring the fold preserves that behaviour while closing the divergence. Signed-off-by: Nuoqi Gui --- v2 -> v3: - Pass existing reg/argno context into check_flow_keys_access(), avoiding a stale regno reference in check_mem_access(). - Add a variable-offset selftest using bpf_get_prandom_u32(). v1 -> v2: - Target bpf-next instead of bpf (per reviewer feedback). - Base-commit updated to bpf-next/master. v2: https://lore.kernel.org/bpf/20260604180730.2518088-1-gnq25@mails.tsinghua.edu.cn/ v1: https://lore.kernel.org/bpf/20260604150755.2487555-1-gnq25@mails.tsinghua.edu.cn/ ==================== Link: https://patch.msgid.link/20260606-c3-01-v3-v3-0-97c51f592f15@mails.tsinghua.edu.cn Signed-off-by: Alexei Starovoitov --- f6cd665c10f1577eca9eef643c9d10ec0435fd61