Re: [PATCH bpf-next v6 6/7] riscv, bpf: Mixing bpf2bpf and tailcalls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Uninitialized Tail Call Count (TCC) in synchronous BPF callbacks allows bypassing tail call limits, leading to kernel stack overflow or DoS.
--

--- Patch [6]: [PATCH bpf-next v6 6/7] riscv, bpf: Mixing bpf2bpf and tailcalls ---
commit c63e8081e54742ee045ae19d7f5fc9de4b31396f
Author: Pu Lehui <pulehui@huawei.com>

riscv, bpf: Mixing bpf2bpf and tailcalls
    
This commit implements mixing bpf2bpf and tailcalls for the RV64 JIT,
similar to x86_64, by using a non-callee saved register to transfer the
TCC between functions and saving that register to the stack. It stores the
TCC back to the stack after bpf2bpf calls or calling the original bpf
func in a bpf trampoline.

> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index 7c6304e0b846a..823262ca47ebf 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
[ ... ]
> @@ -2038,11 +2038,10 @@ void bpf_jit_build_prologue(struct rv_jit_context *ctx, bool is_subprog)
>  	for (i = 0; i < RV_FENTRY_NINSNS; i++)
>  		emit(rv_nop(), ctx);
>  
> -	/* First instruction is always setting the tail-call-counter
> -	 * (TCC) register. This instruction is skipped for tail calls.
> -	 * Force using a 4-byte (non-compressed) instruction.
> -	 */
> -	emit(rv_addi(RV_REG_TCC, RV_REG_ZERO, MAX_TAIL_CALL_CNT), ctx);
> +	if (!is_subprog)
> +		emit(rv_addi(RV_REG_TCC, RV_REG_ZERO, MAX_TAIL_CALL_CNT), ctx);
> +

[Severity: High]
Does skipping TCC initialization for all subprograms leave the TCC uninitialized
for synchronous BPF callbacks?

If a BPF program uses a C helper like bpf_loop() to invoke a synchronous
callback (which is treated as a subprogram where is_subprog is true), the C
helper will have clobbered the RV_REG_TCC (A6) register.

Because the callback skips initializing the TCC, it will inherit whatever
garbage value was left in A6 and save it to the stack. If this callback then
calls another subprogram that executes a tail call, could this garbage TCC
value bypass the tail-call limit, leading to unbounded tail calls and
a kernel stack overflow?

> +	/* tailcall starts here, emit insn before it must be fixed */
>  
>  	emit_addi(RV_REG_SP, RV_REG_SP, -stack_adjust, ctx);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708064436.2971933-1-pulehui@huaweicloud.com?part=6