[PATCH bpf-next v6 09/21] bpf: Refuse a private stack for a program with an exception cleanup table

[Yonghong Song <yonghong.song@linux.dev>]

An unwind resumes a frame at its landing pad rather than at the instruction
after the call. On x86-64 that skips the pop which restores r9, where a
private stack keeps its frame pointer -- the JIT brackets every call in
push_r9/pop_r9 and the pad is reached before the pop runs. The pad would
then address its frame through a stale pointer. Refused on every
architecture rather than just that one.

Force NO_PRIV_STACK in check_max_stack_depth(), where the choice is made.
The subprograms below are then checked against MAX_BPF_STACK together
rather than one at a time, so this can turn a program that would have
loaded with a private stack into one that is too deep.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 kernel/bpf/verifier.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index cc1ed776da15..677bab92f624 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5751,6 +5751,19 @@ static int check_max_stack_depth(struct bpf_verifier_env *env)
 		}
 	}
 
+	/*
+	 * An unwind resumes a frame at its landing pad rather than at the
+	 * instruction after the call, and on x86-64 that skips the pop which
+	 * restores r9 -- where a private stack keeps its frame pointer. The
+	 * pad would address its frame through a stale one. Refused on every
+	 * arch rather than just that one. The subprograms
+	 * below are then checked against MAX_BPF_STACK together rather than
+	 * one at a time, so this can turn a program that would have loaded
+	 * with a private stack into one that is too deep.
+	 */
+	if (env->cleanup_info_cnt)
+		priv_stack_mode = NO_PRIV_STACK;
+
 	if (priv_stack_mode == PRIV_STACK_UNKNOWN)
 		priv_stack_mode = bpf_enable_priv_stack(env->prog);
 
-- 
2.53.0-Meta