[PATCH bpf-next v11 08/26] bpf: Refuse a callback that can unwind

[Yonghong Song <yonghong.song@linux.dev>]

A callback is not called by the program but by kernel code, a helper or
a kfunc such as bpf_loop(), which the callback returns to and which then
returns to the program:

  main -> A -> bpf_loop() -> cb -> C          C calls bpf_unwind()

Once a later patch makes bpf_unwind() dispatch pads, it rewrites the
return address of each of the program's frames and stops at the first
frame that is not one, here bpf_loop(): kernel code with its own frame
and state, which the walk cannot send cb past. So cb returns into
bpf_loop(), which goes on looping and then returns to A after its call,
while the verifier follows the unwind from cb straight into A.

Refuse a callback subprog marked might_unwind. The check does not depend
on a cleanup table: without one, bpf_unwind() still sends every frame it
walks through its epilogue and still stops at bpf_loop(), so the
mismatch is the same.

The check does not tell the kinds of callback apart, so an async one, a
timer callback for example, is refused as well, although nothing of the
program sits above it for the walk to skip. And as
mark_callx_might_unwind() marks a subprog with a callx conservatively, a
callback with a callx is refused even when nothing it calls unwinds.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 kernel/bpf/exception.c | 9 +++++++++
 kernel/bpf/exception.h | 1 +
 kernel/bpf/verifier.c  | 4 ++++
 3 files changed, 14 insertions(+)

diff --git a/kernel/bpf/exception.c b/kernel/bpf/exception.c
index 80d1edc19441..316ae9e4d7c7 100644
--- a/kernel/bpf/exception.c
+++ b/kernel/bpf/exception.c
@@ -141,6 +141,15 @@ int bpf_exc_check_info(struct bpf_verifier_env *env, const union bpf_attr *attr,
 BTF_ID_LIST_SINGLE(bpf_unwind_id, func, bpf_unwind)
 BTF_ID_LIST_SINGLE(bpf_unwind_resume_id, func, bpf_unwind_resume)
 
+int bpf_exc_check_callback(struct bpf_verifier_env *env, int subprog)
+{
+	if (!env->subprog_info[subprog].might_unwind)
+		return 0;
+
+	verbose(env, "subprog %d may unwind and is used as a callback\n", subprog);
+	return -EINVAL;
+}
+
 static int reject_throw(struct bpf_verifier_env *env)
 {
 	u32 i;
diff --git a/kernel/bpf/exception.h b/kernel/bpf/exception.h
index 30918714a6e8..49d4685c297a 100644
--- a/kernel/bpf/exception.h
+++ b/kernel/bpf/exception.h
@@ -17,5 +17,6 @@ int bpf_exc_check_prog(struct bpf_verifier_env *env);
 int bpf_exc_pad_of_call(struct bpf_verifier_env *env, u32 idx);
 bool bpf_is_unwind_kfunc(const struct bpf_insn *insn);
 bool bpf_is_unwind_resume_kfunc(const struct bpf_insn *insn);
+int bpf_exc_check_callback(struct bpf_verifier_env *env, int subprog);
 
 #endif /* __BPF_EXCEPTION_H */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fe24291260a0..9c88b68e4235 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11191,6 +11191,10 @@ static int push_callback_call(struct bpf_verifier_env *env, struct bpf_insn *ins
 	 * callbacks
 	 */
 	env->subprog_info[subprog].is_cb = true;
+	err = bpf_exc_check_callback(env, subprog);
+	if (err)
+		return err;
+
 	if (bpf_pseudo_kfunc_call(insn) &&
 	    !is_callback_calling_kfunc(insn->imm)) {
 		verifier_bug(env, "kfunc %s#%d not marked as callback-calling",
-- 
2.53.0-Meta