[PATCH bpf-next v2 09/20] bpf: Refuse a private stack for a program with an exception cleanup table

[Yonghong Song <yonghong.song@linux.dev>]

A landing pad is about to start running outside its own frame, on the
bpf_throw() walker's stack, with that frame's registers put back from a
spill area whose contents arch_bpf_run_cleanup_pad() knows how to read. The
x86-64 JIT addresses a private-stack program's frame through a scratch
register that it recomputes after each call rather than through rbp, and no
spill area holds that register, so a pad there would address its frame
through whatever the kernel left behind.

Refuse the combination in check_max_stack_depth(), where the choice is
made. Everywhere rather than arch-conditionally: arm64 keeps its private
stack pointer in x27, which is in the prologue spill and so survives, but a
rule that holds on one arch and not the other is not worth the second code
path when nothing is lost but an optimization.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 kernel/bpf/verifier.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a3b34ded1392..43ecf79baa4a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5591,6 +5591,14 @@ static int check_max_stack_depth(struct bpf_verifier_env *env)
 		}
 	}
 
+	/*
+	 * A pad rebuilds its frame from a spill area, and on x86-64 a private
+	 * stack's frame pointer is in no spill area. Refused on every arch
+	 * rather than just that one.
+	 */
+	if (env->cleanup_info_cnt)
+		priv_stack_mode = NO_PRIV_STACK;
+
 	if (priv_stack_mode == PRIV_STACK_UNKNOWN)
 		priv_stack_mode = bpf_enable_priv_stack(env->prog);
 
-- 
2.53.0-Meta