Re: [PATCH bpf-next v6 12/21] bpf, arm64: Dispatch exception cleanup pads at run time

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf, arm64: flawed PAC detection heuristic in bpf_unwind_store_ra()
--

commit 8fd536108380da02aed3e75e4a2d05875d208201
Author: Yonghong Song <yonghong.song@linux.dev>

bpf, arm64: Dispatch exception cleanup pads at run time

This commit implements the runtime dispatch of exception cleanup pads
for the ARM64 BPF JIT. It integrates with the stack unwinder to replace
and correctly sign return addresses using pointer authentication (PAC)
where necessary.

> diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
> index 3ebcf8c53fb04..c750c520f24d9 100644
> --- a/arch/arm64/kernel/stacktrace.c
> +++ b/arch/arm64/kernel/stacktrace.c

[ ... ]

> +static bool bpf_unwind_store_ra(unsigned long record, unsigned long caller_fp,
> +				u64 pc, u64 ra)
> +{
> +	struct frame_record *rec = (struct frame_record *)record;
> +	u64 stored = READ_ONCE(rec->lr);
> +
> +	if (system_supports_address_auth() && stored != pc) {

[Severity: High]
Does this heuristic fail when the generated Pointer Authentication Code (PAC)
matches the sign-extension bits?

The hardware PAC algorithm uniformly generates pseudo-random hashes.
There is a non-zero probability (e.g., ~1/128 for a 7-bit PAC on a 48-bit VA)
that the generated PAC perfectly matches the sign-extension bits (all 1s).

When this collision occurs, the PAC-stripped pc equals the unstripped
stored value despite the pointer actually being signed. The unwinder
would then incorrectly assume the frame was unsigned and write the
replacement return address (ra) to the stack unsigned.

When the BPF epilogue subsequently executes AUTIASP, wouldn't the
authentication fail, corrupting the pointer and triggering a fatal trap
on RET?

> +		u64 modifier;
> +
> +		if (WARN_ON_ONCE(!bpf_unwind_ra_modifier(record, caller_fp,
> +							 stored, pc, &modifier)))
> +			return false;
> +		ra = bpf_unwind_sign_ra(ra, modifier);
> +	}
> +	WRITE_ONCE(rec->lr, ra);
> +	return true;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926050006.2213110-1-yonghong.song@linux.dev?part=12