check_stack_write_fixed_off() uses one byte-indexing scheme when checking
whether a fixed-offset stack write needs Spectre v4 sanitization, and another
scheme when recording the write into slot_type[].
For sub-8-byte writes this can make the sanitization check look at bytes that
are not overwritten by the write. A zeroed lower half-slot followed by a write
to the upper half-slot can therefore miss the nospec barrier for the second
write.
Use the same stack-byte index for the sanitization check and the slot update,
and add a focused verifier selftest that expects both half-slot writes to emit
nospec through the unprivileged loader lane.
Bounded impact: this fixes verifier/JIT Spectre v4 mitigation emission for a
fixed-offset stack-write corner case. No architectural verifier memory-safety
bypass, exploit chain, CVE, embargo, or security escalation is claimed.
Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store
bypass mitigation")
Signed-off-by: Nuoqi Gui <[email protected]>
---
Changes in v3:
- selftests/bpf: drop the stray space in the __xlated_unpriv stack-store
expectations ("(r10 - 4)"/"(r10 - 8)" -> "(r10 -4)"/"(r10 -8)")
- Link to v2:
https://lore.kernel.org/bpf/20260618-f01-11-stack-nospec-slot-index-v2-0-ede949535...@mails.tsinghua.edu.cn/
Changes in v2:
- drop __caps_unpriv(CAP_BPF) from the selftest
- fix selftest style
- use Fixes: 2039f26f3aca per review
- Link to v1:
https://lore.kernel.org/bpf/20260617-f01-11-stack-nospec-slot-index-v1-0-e3a080b0c...@mails.tsinghua.edu.cn/
---
Nuoqi Gui (2):
bpf: Fix stack slot index in nospec checks
selftests/bpf: Cover stack nospec slot indexing
kernel/bpf/verifier.c | 3 ++-
.../testing/selftests/bpf/progs/verifier_unpriv.c | 22 ++++++++++++++++++++++
2 files changed, 24 insertions(+), 1 deletion(-)
---
base-commit: e4287bf34f97a88c7d9322f5bde828724c073a6b
change-id: 20260615-f01-11-stack-nospec-slot-index-e155b2acd587
Best regards,
--
Nuoqi Gui <[email protected]>
