Commit c845894e authored by Daniel Wade's avatar Daniel Wade Committed by Alexei Starovoitov
Browse files

bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR 



maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the
source operand is a constant.  When dst has signed range [-1, 0], it
forks the verifier state: the pushed path gets dst = 0, the current
path gets dst = -1.

For BPF_AND this is correct: 0 & K == 0.
For BPF_OR this is wrong:    0 | K == K, not 0.

The pushed path therefore tracks dst as 0 when the runtime value is K,
producing an exploitable verifier/runtime divergence that allows
out-of-bounds map access.

Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to
push_stack(), so the pushed path re-executes the ALU instruction with
dst = 0 and naturally computes the correct result for any opcode.

Fixes: bffacdb8 ("bpf: Recognize special arithmetic shift in the verifier")
Signed-off-by: default avatarDaniel Wade <danjwade95@gmail.com>
Reviewed-by: default avatarAmery Hung <ameryhung@gmail.com>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260314021521.128361-2-danjwade95@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 1abd3feb

kernel/bpf/verifier.c

+1 −1
Original line number Diff line number Diff line
@@ -15999,7 +15999,7 @@ static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *ins 
	else

		return 0;









	branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);









	branch = push_stack(env, env->insn_idx, env->insn_idx, false);









	if (IS_ERR(branch))









		return PTR_ERR(branch);