[PATCHv2 bpf-next 0/2] bpf: Disable private stacks for uprobe programs

[Jiri Olsa <jolsa@kernel.org>]

hi,
uprobe programs can be preempted and re-entered on the same CPU. Since
the private stack is shared per program and CPU, a nested invocation can
overwrite the preempted invocation's stack.

This patch disables private stacks for KPROBE programs except kprobe multi
and kprobe-session programs, identified by the BPF_TRACE_KPROBE_MULTI and
BPF_TRACE_KPROBE_SESSION attach types. Standard kprobes lack an attach type,
and uprobes use different attach types or none, so they run without private
stacks.

It also rejects multi and session programs through the perf-event attach
path, which lacks their required run context and could allow a uprobe to
reach a private-stack tail-call target [1].

thanks,
jirka


v1: https://lore.kernel.org/bpf/20261103093400.112178-1-jolsa@kernel.org/

v2 changes:
- drop the BPF_TRACE_UPROBE attach type and fail perf event kprobe
  attach for kprobe-multi/uprobe-multi [Alexei]


[1] https://lore.kernel.org/bpf/aus-b8Lo2oCw_cGd@krava/
---
Jiri Olsa (2):
      bpf: Reject multi kprobe programs in perf event attach
      bpf: Disable private stacks for untagged kprobe programs

 kernel/bpf/verifier.c                                      |  9 +++++++
 kernel/events/core.c                                       | 13 ++++++++--
 tools/testing/selftests/bpf/progs/verifier_large_stack.c   |  2 +-
 tools/testing/selftests/bpf/progs/verifier_private_stack.c | 38 +++++++++++++++++++++++++++--
 4 files changed, 57 insertions(+), 5 deletions(-)