Re: [PATCH bpf-next v2 11/20] bpf, x86: Dispatch exception cleanup pads at run time

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf, x86: garbage kfunc stack arguments in exception cleanup pads
--

commit 1e32297a3c2c4f6bbc4d458bc25563bed8167f6c
Author: Yonghong Song <yonghong.song@linux.dev>

bpf, x86: Dispatch exception cleanup pads at run time

This commit provides the architecture-specific support for x86-64 exception
cleanup pads. It forces a full callee-saved spill for programs with a cleanup
table and introduces arch_bpf_run_cleanup_pad to execute the pads.

> diff --git a/arch/x86/net/bpf_cleanup_pad.S b/arch/x86/net/bpf_cleanup_pad.S
> new file mode 100644
> index 0000000000000..da4b448ecf095
> --- /dev/null
> +++ b/arch/x86/net/bpf_cleanup_pad.S

[ ... ]

> +SYM_FUNC_START(arch_bpf_run_cleanup_pad)
> +	ANNOTATE_NOENDBR
> +
> +	pushq %rbp
> +	pushq %rbx
> +	pushq %r12
> +	pushq %r13
> +	pushq %r14
> +	pushq %r15
> +	/* Keep the pad's entry rsp congruent to a normal call's. */
> +	subq $8, %rsp
> +
> +	movq 0(%rdx), %r15
> +	movq 8(%rdx), %r14
> +	movq 16(%rdx), %r13
> +	movq 24(%rdx), %rbx
> +	movq 32(%rdx), %r12
> +	/* rbp is BPF r10, so this is the whole of the pad's frame setup. */
> +	movq %rsi, %rbp
> +
> +	/* CALL_NOSPEC needs the target in a register; rcx is BPF r4, dead. */
> +	movq %rdi, %rcx
> +
> +	/* BPF r0 on the way into a pad, not whatever the kernel left in rax. */
> +	movl $BPF_PAD_ENTRY_R0, %eax
> +
> +	CALL_NOSPEC rcx

[Severity: High]
Does this execution environment cause kfuncs with more than 5 arguments
to read uninitialized garbage stack arguments?

In arch_bpf_run_cleanup_pad, the pad is executed on the unwinder's
stack (rsp), while rbp is set to the original BPF frame.

However, the JIT unconditionally writes outgoing kfunc stack arguments
relative to BPF_REG_FP (rbp), as seen in emit_kfunc_arg_moves in
arch/x86/net/bpf_jit_comp.c:

                else if (dst_mem)
                        emit_stx(&prog, BPF_DW, BPF_REG_FP, reg,
                                 stack_base + (dst - nreg) * 8);

Because rbp and rsp are desynchronized in the pad, the arguments are
written to the old frame. When the kfunc is called, the C calling
convention requires it to read stack arguments from [rsp], which points
to the unwinder's stack instead of the original frame, leading to
garbage reads.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918044156.3283973-1-yonghong.song@linux.dev?part=11