[PATCH bpf] libbpf: Enforce program limit only for loaded programs

[Mahe Tardy <mahe.tardy@gmail.com>]

As explained in commit '259172bb6514 ("libbpf: Fix gen_loader assumption
on number of programs.")', nr_progs which is obj->nr_programs at this
stage is including subprogs and autoload=false progs which are filtered
later during the generation.

Quoting Alexei, previous patch 'aac5ba0a4d52 ("libbpf: Reject excessive
program counts in generated loaders")' does move rejection at gen time
instead of load time, but some programs are still wrongfully rejected:

  Two objects with obj->nr_programs == 33:

    object               before aac5ba0a  after aac5ba0a should be
    -------------------  ---------------  -------------  -------------
    33 progs             -EACCES at load  -E2BIG at gen  -E2BIG at gen
    1 prog, 32 subprogs  -EACCES at load  -E2BIG at gen  loads

  The second object fails today because of the cleanup loop in
  bpf_gen__init(). It closes nr_progs slots of prog_fd[], and
  prog_fd[32] is at r10 + 0:

    r1 = *(u32 *)(r10 +0)
    invalid read from stack R10 off=0 size=4

We now clamp the loop generating the cleanups, which may still be more
numerous than necessary and do the actual E2BIG check just before
writing the actual prog_fd into the stack for the cleanups, after
bpf_object__load_progs() has been doing the filtering on progs.

Fixes: aac5ba0a4d52 ("libbpf: Reject excessive program counts in generated loaders")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
 tools/lib/bpf/gen_loader.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tools/lib/bpf/gen_loader.c b/tools/lib/bpf/gen_loader.c
index 80a6b5306183..555d4757a898 100644
--- a/tools/lib/bpf/gen_loader.c
+++ b/tools/lib/bpf/gen_loader.c
@@ -122,11 +122,6 @@ void bpf_gen__init(struct bpf_gen *gen, int log_level, int nr_progs, int nr_maps
 	gen->log_level = log_level;
 	gen->nr_obj_maps = nr_maps;
 	gen->max_func_ptr_maps = max_func_ptr_maps;
-	if (nr_progs > MAX_USED_PROGS) {
-		pr_warn("Total programs exceeds %d\n", MAX_USED_PROGS);
-		gen->error = -E2BIG;
-		return;
-	}
 	if (nr_maps + max_func_ptr_maps > MAX_USED_MAPS) {
 		pr_warn("Total maps exceeds %d\n", MAX_USED_MAPS);
 		gen->error = -E2BIG;
@@ -144,6 +139,8 @@ void bpf_gen__init(struct bpf_gen *gen, int log_level, int nr_progs, int nr_maps
 	emit(gen, BPF_MOV64_IMM(BPF_REG_3, 0));
 	emit(gen, BPF_EMIT_CALL(BPF_FUNC_probe_read_kernel));

+	/* nr_progs includes subprogs and progs that are not loaded */
+	nr_progs = min(nr_progs, MAX_USED_PROGS);
 	/* amount of stack actually used, only used to calculate iterations, not stack offset */
 	nr_progs_sz = offsetof(struct loader_stack, prog_fd[nr_progs]);
 	/* jump over cleanup code */
@@ -1139,6 +1136,11 @@ void bpf_gen__prog_load(struct bpf_gen *gen,
 		gen->attach_kind = 0;
 	}
 	emit_check_err(gen);
+	if (gen->nr_progs == MAX_USED_PROGS) {
+		pr_warn("Total programs exceeds %d\n", MAX_USED_PROGS);
+		gen->error = -E2BIG;
+		return;
+	}
 	/* remember prog_fd in the stack, if successful */
 	emit(gen, BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_7,
 			      stack_off(prog_fd[gen->nr_progs])));
--
2.43.0