Re: [PATCH bpf v2] bpf: guard uprobes against private-stack corruption

[Jiri Olsa <olsajiri@gmail.com>]

On Sun, Aug 23, 2026 at 12:05:40AM +0100, Christian Simon wrote:
> On Sat, 22 Aug 2026 at 21:36, Jiri Olsa <olsajiri@gmail.com> wrote:
> >
> > On Fri, Aug 21, 2026 at 11:06:16AM -0700, Andrii Nakryiko wrote:
> > > On Tue, Aug 18, 2026 at 1:33 PM Christian Simon <simon@swine.de> wrote:
> > > >
> > > > Eligible BPF programs use one private stack per program and CPU. Both
> > > > bpf_prog_run_array_uprobe() and uprobe_prog_run() use migrate_disable()
> > > > to keep an invocation on one CPU, but another task can still preempt it
> > > > and run the same program on that CPU. The second invocation then reuses
> > > > and can overwrite the first invocation's private stack.
> > > >
> > > > Protect each real program invocation with the existing per-program
> > > > recursion context. When the program is already active on this CPU,
> > > > account for the missed invocation and skip it. Return zero when skipping
> > > > an uprobe-multi invocation so session handling does not suppress its
> > > > return probe.
> > > >
> > > > Skip dummy_bpf_prog in the classic array path before acquiring the
> > > > recursion context because its active pointer is NULL.
> > > >
> > > > Add a regression test that pins two threads to one CPU and overlaps
> > > > classic and multi uprobe invocations while preserving a sentinel in a
> > > > private stack frame. Without the guards, the second invocation executes
> > > > and corrupts the first invocation's sentinel.
> > > >
> > > > Fixes: 7d1cd70d4b16 ("bpf, x86: Support private stack in jit")
> > > > Fixes: 6c17a882d380 ("bpf, arm64: JIT support for private stack")
> > > > Closes: https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/issues/3056
> > > > Cc: stable@vger.kernel.org
> > > > Signed-off-by: Christian Simon <simon@swine.de>
> > > > ---
> > > > Changes in v2:
> > > > - Address review comments from sashiko-bot
> > > >   - Guard the uprobe-multi path as well.
> > > >   - Remove const from correct line
> > > > - Add a regression selftest for uprobe-classic/multi paths.
> > > > - Add the arm64 Fixes tag.
> > > >
> > > >  include/linux/bpf.h                           |  33 +++--
> > > >  kernel/trace/bpf_trace.c                      |  11 +-
> > > >  .../bpf/prog_tests/uprobe_private_stack.c     | 118 ++++++++++++++++++
> > > >  .../bpf/progs/uprobe_private_stack.c          |  54 ++++++++
> > > >  4 files changed, 206 insertions(+), 10 deletions(-)
> > > >  create mode 100644 tools/testing/selftests/bpf/prog_tests/uprobe_private_stack.c
> > > >  create mode 100644 tools/testing/selftests/bpf/progs/uprobe_private_stack.c
> > > >
> > > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > > > index 7719f6528445..a94fc9898ece 100644
> > > > --- a/include/linux/bpf.h
> > > > +++ b/include/linux/bpf.h
> > > > @@ -2572,6 +2572,14 @@ static inline void bpf_reset_run_ctx(struct bpf_run_ctx *old_ctx)
> > > >
> > > >  typedef u32 (*bpf_prog_run_fn)(const struct bpf_prog *prog, const void *ctx);
> > > >
> > > > +#ifdef CONFIG_BPF_SYSCALL
> > > > +void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog);
> > > > +#else
> > > > +static inline void bpf_prog_inc_misses_counter(struct bpf_prog *prog)
> > > > +{
> > > > +}
> > > > +#endif
> > > > +
> > > >  static __always_inline u32
> > > >  bpf_prog_run_array(const struct bpf_prog_array *array,
> > > >                    const void *ctx, bpf_prog_run_fn run_prog)
> > > > @@ -2617,7 +2625,7 @@ bpf_prog_run_array_uprobe(const struct bpf_prog_array *array,
> > > >                           const void *ctx, bpf_prog_run_fn run_prog)
> > > >  {
> > > >         const struct bpf_prog_array_item *item;
> > > > -       const struct bpf_prog *prog;
> > > > +       struct bpf_prog *prog;
> > > >         struct bpf_run_ctx *old_run_ctx;
> > > >         struct bpf_trace_run_ctx run_ctx;
> > > >         u32 ret = 1;
> > > > @@ -2635,15 +2643,30 @@ bpf_prog_run_array_uprobe(const struct bpf_prog_array *array,
> > > >         old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
> > > >         item = &array->items[0];
> > > >         while ((prog = READ_ONCE(item->prog))) {
> > > > +               /* dummy_bpf_prog has no recursion state. */
> > > > +               if (unlikely(!prog->len)) {
> > > > +                       item++;
> > > > +                       continue;
> > > > +               }
> > > > +
> > > > +               if (unlikely(!bpf_prog_get_recursion_context(prog))) {
> > > > +                       bpf_prog_inc_misses_counter(prog);
> > > > +                       bpf_prog_put_recursion_context(prog);
> > > > +                       item++;
> > > > +                       continue;
> > > > +               }
> > > > +
> > >
> > > I think it's unacceptable to skip sleepable uprobe execution just
> > > because there is the same BPF program attached to a *different* uprobe
> > > (and all due to a private stack that no one asked for or needs for
> > > uprobes, really).
> > >
> > > As a short-term fix, we should probably disable private stack for
> > > sleepable uprobe/kprobe program (and tracepoint/raw_tracepoint), and
> > > think how we can make private stack less per-CPU dependent.
> >
> > +1 for disabling private stack for uprobes
> >
> > thanks,
> > jirka
> 
> Thanks for your guidance. I have just posted v3 of the patch set, which
> disables private stacks for sleepable programs.
> 
> I am still unsure why non-sleepable uprobes would be unaffected. On a

I think we need to disable both sleepable and non-sleepable uprobes

problem is that we can't say if kprobe program is going to be attached
as uprobe or kprobe, so we'd need to disable both kprobe/uprobes, which
I'm not sure is a problem

I don't see how tracepoint/raw_tracepoint are affected by this problem,
because they have either retursion context or bpf_prog_active check

jirka


> preemptible kernel, their execution paths use migrate_disable() rather than
> preempt_disable(), and rcu_read_lock() does not prevent preemption with
> preemptible RCU. It therefore seems possible for a task to be scheduled out
> while running a non-sleepable uprobe, after which another task could invoke the
> same program on the same CPU and reuse its per-CPU, per-program private stack.
> Am I missing another mechanism that prevents this?
> 
> Cheers,
> Christian
> 
> ---
> v3: https://lore.kernel.org/bpf/20260822225444.2774461-1-simon@swine.de/