From nobody Fri Oct 10 16:01:09 2025 Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 524202F2C48; Fri, 13 Jun 2025 07:37:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.183.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800262; cv=none; b=tYw9Bgvb1ohUnXE+934SlG4FpMITrmqlW/QkTR1TN/InxLdtRNeuOiYDygTPE6XDqEJa1Uifq9RlXuk1SMQw1v6fOdVtcn8paiTdMtmQQzWs2naQ/bnYYz4Fpi2EsYx5dd0sLXmbrp/YZogqaFumo6jE6/HEsGbasdd6O2BtsUA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800262; c=relaxed/simple; bh=r99sJfu4ewPRyz0zJbWXJMYkpw47S2rIyZaupP+jn1g=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Asnr47XufE5fM8TKd2uS9Q22SnFePE6xGBSbevUIqLe4fp0vfNcbj68wTFcECBqwsgG7OOgzYYpy1yk8THmF000Mq1b6jGeuyrnIqEfUu3pcKIFV1ExjtSiqOQFaWGCm9fshQScR1/dF5bAPKh4uSOleAK/74+XlUI8Nx2lN5Ic= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=cAFx4niw; arc=none smtp.client-ip=217.70.183.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="cAFx4niw" Received: by mail.gandi.net (Postfix) with ESMTPSA id CCC6B44506; Fri, 13 Jun 2025 07:37:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1749800250; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rWrXudQ87v1aByOGhl67T4UU7KUM5mT6FEm5oZqhcLg=; b=cAFx4niwDDsyQFKGdmMcGf11CvIpcE6i60PNTLVL6XAEHr8QsvAnUtPgghd0BMq2R+ppDC FFai5U507SCN+pyoN6wuDoWlTMOjSSoP4TnpNxYiC+w0QbX1ZUzPQlhl134JonesXJvjFx OWDw6aSbLFZe7FDXXsBj2S+b7DQHMXAKYwDHAWLiIwLUr5ryMSKFEAsH//6LX4WvBNf7+B RTSk1TpiSwF389Xnh71A9SzYutIAanBG+/eJ2O3NS8i6MD2qG3qY8IPYR+kJcbwUdA/tQF SzpnBSDBVvIxVqUtGLlQS7VmjGVpj6a1tNP17AMJbhSHMVv02WVX06WVxtBTDQ== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Fri, 13 Jun 2025 09:37:10 +0200 Subject: [PATCH bpf 1/7] bpf/x86: use define for max regs count used for arguments Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250613-deny_trampoline_structs_on_stack-v1-1-5be9211768c3@bootlin.com> References: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> In-Reply-To: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Menglong Dong , =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , Pu Lehui , Puranjay Mohan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Hari Bathini , Christophe Leroy , Naveen N Rao , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Mykola Lysenko , Shuah Khan , Maxime Coquelin , Alexandre Torgue Cc: ebpf@linuxfoundation.org, Thomas Petazzoni , Bastien Curutchet , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.14.2 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtddugddujeefjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephfffufggtgfgkfhfjgfvvefosehtkeertdertdejnecuhfhrohhmpeetlhgvgihishcunfhothhhohhrroculdgvuefrhfcuhfhouhhnuggrthhiohhnmdcuoegrlhgvgihishdrlhhothhhohhrvgessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnhepleejkeetffefveelgeeklefhtefhgfeigeduveffjeehleeifeefjedtudejgeeunecukfhppedvrgdtvdemkeegvdekmehfleegtgemvgdttdemmehfkeehnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvdgrtddvmeekgedvkeemfhelgegtmegvtddtmeemfhekhedphhgvlhhopegludelvddrudeikedruddrudeljegnpdhmrghilhhfrhhomheprghlvgigihhsrdhlohhthhhorhgvsegsohhothhlihhnrdgtohhmpdhnsggprhgtphhtthhopeehkedprhgtphhtthhopehsohhngheskhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprghgohhruggvvghvsehlihhnuhigrdhisghmrdgtohhmpdhrtghpthhtoheplhhinhhugihpphgtqdguvghvsehlihhsthhsrdhoiihlrggsshdrohhrghdprhgtphhtthhopehlihhnuhigq dhkshgvlhhfthgvshhtsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqshhtmhefvdesshhtqdhmugdqmhgrihhlmhgrnhdrshhtohhrmhhrvghplhihrdgtohhmpdhrtghpthhtoheprghlvgigrghnughrvgdrthhorhhguhgvsehfohhsshdrshhtrdgtohhmpdhrtghpthhtohepmhihkhholhgrlhesfhgsrdgtohhmpdhrtghpthhtohepshhvvghnsheslhhinhhugidrihgsmhdrtghomh X-GND-Sasl: alexis.lothore@bootlin.com x86 allows using up to 6 registers to pass arguments between function calls. This value is hardcoded in multiple places, use a define for this value. Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/x86/net/bpf_jit_comp.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 15672cb926fc1817f97d2cd1c55d1575803f6958..9689834de1bb1a90fdc28156e0e= 2a56ac0ff2076 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -61,6 +61,8 @@ static u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len) #define EMIT_ENDBR_POISON() #endif =20 +#define MAX_REGS_FOR_ARGS 6 + static bool is_imm8(int value) { return value <=3D 127 && value >=3D -128; @@ -2710,10 +2712,10 @@ static int get_nr_used_regs(const struct btf_func_m= odel *m) =20 for (i =3D 0; i < min_t(int, m->nr_args, MAX_BPF_FUNC_ARGS); i++) { arg_regs =3D (m->arg_size[i] + 7) / 8; - if (nr_used_regs + arg_regs <=3D 6) + if (nr_used_regs + arg_regs <=3D MAX_REGS_FOR_ARGS) nr_used_regs +=3D arg_regs; =20 - if (nr_used_regs >=3D 6) + if (nr_used_regs >=3D MAX_REGS_FOR_ARGS) break; } =20 @@ -2751,7 +2753,7 @@ static void save_args(const struct btf_func_model *m,= u8 **prog, * the arg1-5,arg7 will be passed by regs, and arg6 will * by stack. */ - if (nr_regs + arg_regs > 6) { + if (nr_regs + arg_regs > MAX_REGS_FOR_ARGS) { /* copy function arguments from origin stack frame * into current stack frame. * @@ -2811,7 +2813,7 @@ static void restore_regs(const struct btf_func_model = *m, u8 **prog, */ for (i =3D 0; i < min_t(int, m->nr_args, MAX_BPF_FUNC_ARGS); i++) { arg_regs =3D (m->arg_size[i] + 7) / 8; - if (nr_regs + arg_regs <=3D 6) { + if (nr_regs + arg_regs <=3D MAX_REGS_FOR_ARGS) { for (j =3D 0; j < arg_regs; j++) { emit_ldx(prog, BPF_DW, nr_regs =3D=3D 5 ? X86_REG_R9 : BPF_REG_1 + nr_regs, @@ -2824,7 +2826,7 @@ static void restore_regs(const struct btf_func_model = *m, u8 **prog, stack_size -=3D 8 * arg_regs; } =20 - if (nr_regs >=3D 6) + if (nr_regs >=3D MAX_REGS_FOR_ARGS) break; } } @@ -3149,7 +3151,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_t= ramp_image *im, void *rw_im stack_size +=3D (sizeof(struct bpf_tramp_run_ctx) + 7) & ~0x7; run_ctx_off =3D stack_size; =20 - if (nr_regs > 6 && (flags & BPF_TRAMP_F_CALL_ORIG)) { + if (nr_regs > MAX_REGS_FOR_ARGS && (flags & BPF_TRAMP_F_CALL_ORIG)) { /* the space that used to pass arguments on-stack */ stack_size +=3D (nr_regs - get_nr_used_regs(m)) * 8; /* make sure the stack pointer is 16-byte aligned if we --=20 2.49.0 From nobody Fri Oct 10 16:01:09 2025 Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D6082ED850; Fri, 13 Jun 2025 07:37:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.183.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800261; cv=none; b=mZBLvEjRET+4HCcOS4BLI6ET4W4mRqis8DbnT7LSG2gF4SCHiqTh+jaVgX9kT3rV2BhFM6FDmI/h8a2pOFuTsTHcy5QB2QDvljd4TN5tFFnSLTKMh8B7eUgPh8bp6puTPuszCzZUUAFfJ9CXaXmQj1d9F/adMYYJAjUadmf/sXE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800261; c=relaxed/simple; bh=idff8F+7CyV7Nz6myK6drIDa22L2irpitNy5yJ9Rr7s=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OXHT4g6cV3Fh8mbqPONK8UXENQh1+4mHARxedI5WPe98TFW0uicV5QSH+KV5EfRwpiz9gJoLykYGuTPow7/7Qp/Baf7M9mPpnp/LurS+EGcC+NENtwNFMnXLlNsAo+zXsPXqbQ6+PXm2D7Yr0dkVMvssf+8yWsKDurlJAcKeHEM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=hjz+up3o; arc=none smtp.client-ip=217.70.183.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="hjz+up3o" Received: by mail.gandi.net (Postfix) with ESMTPSA id 09B4044504; Fri, 13 Jun 2025 07:37:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1749800254; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MnHGDvZzrjKVg91VYE4fUbD95rOheLuWrUC1SCUNvho=; b=hjz+up3owp19jC1PLRYly2+dyctAQgkbxpKo1hqYq1HETrfATLqzq1SfruQePM9/7t5pLa 0zTgV4Mt+jHNfjm41uNZRq3n71py93L9O+7KZhUPST/iQHmzyaGpfn7MSZ8OgZbCmciiE7 GxM/QOW8RLxX86eh4eiqAagDX+1Yh47rRt5h5IfedzZXFQZhW4NYI7kCZJcYIItqps3uLX BZnHjMANkEjvI0mf6/VMLdo44AkZvBkC/epgTg/TqottCOybUirzxNFNynKpbkqAqLHbRi dv/ae9NbgtJ9xY7jGbo/ojuHvNaSLl6MZIZ/7dtwKDtTbHVzpUbjlkT5KrLJbQ== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Fri, 13 Jun 2025 09:37:11 +0200 Subject: [PATCH bpf 2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250613-deny_trampoline_structs_on_stack-v1-2-5be9211768c3@bootlin.com> References: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> In-Reply-To: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Menglong Dong , =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , Pu Lehui , Puranjay Mohan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Hari Bathini , Christophe Leroy , Naveen N Rao , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Mykola Lysenko , Shuah Khan , Maxime Coquelin , Alexandre Torgue Cc: ebpf@linuxfoundation.org, Thomas Petazzoni , Bastien Curutchet , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.14.2 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtddugddujeefjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephfffufggtgfgkfhfjgfvvefosehtkeertdertdejnecuhfhrohhmpeetlhgvgihishcunfhothhhohhrroculdgvuefrhfcuhfhouhhnuggrthhiohhnmdcuoegrlhgvgihishdrlhhothhhohhrvgessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnhepleejkeetffefveelgeeklefhtefhgfeigeduveffjeehleeifeefjedtudejgeeunecukfhppedvrgdtvdemkeegvdekmehfleegtgemvgdttdemmehfkeehnecuvehluhhsthgvrhfuihiivgepudenucfrrghrrghmpehinhgvthepvdgrtddvmeekgedvkeemfhelgegtmegvtddtmeemfhekhedphhgvlhhopegludelvddrudeikedruddrudeljegnpdhmrghilhhfrhhomheprghlvgigihhsrdhlohhthhhorhgvsegsohhothhlihhnrdgtohhmpdhnsggprhgtphhtthhopeehkedprhgtphhtthhopehsohhngheskhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprghgohhruggvvghvsehlihhnuhigrdhisghmrdgtohhmpdhrtghpthhtoheplhhinhhugihpphgtqdguvghvsehlihhsthhsrdhoiihlrggsshdrohhrghdprhgtphhtthhopehlihhnuhigq dhkshgvlhhfthgvshhtsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqshhtmhefvdesshhtqdhmugdqmhgrihhlmhgrnhdrshhtohhrmhhrvghplhihrdgtohhmpdhrtghpthhtoheprghlvgigrghnughrvgdrthhorhhguhgvsehfohhsshdrshhtrdgtohhmpdhrtghpthhtohepmhihkhholhgrlhesfhgsrdgtohhmpdhrtghpthhtohepshhvvghnsheslhhinhhugidrihgsmhdrtghomh X-GND-Sasl: alexis.lothore@bootlin.com When the target function receives more arguments than available registers, the additional arguments are passed on stack, and so the generated trampoline needs to read those to prepare the bpf context, but also to prepare the target function stack when it is in charge of calling it. This works well for scalar types, but if the value is a struct, we can not know for sure the exact struct location, as it may have been packed or manually aligned to a greater value. Prevent wrong readings by refusing trampoline attachment if the target function receives a struct on stack. While at it, move the max bpf args check in the new function. Fixes: 473e3150e30a ("bpf, x86: allow function arguments up to 12 for TRACI= NG") Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/x86/net/bpf_jit_comp.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 9689834de1bb1a90fdc28156e0e2a56ac0ff2076..120e05a978679c046631cc94d94= 2800c3051ad0a 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -3001,6 +3001,29 @@ static int invoke_bpf_mod_ret(const struct btf_func_= model *m, u8 **pprog, return 0; } =20 +static int validate_args(const struct btf_func_model *m) +{ + int i, arg_regs =3D 0, nr_regs =3D 0; + + for (i =3D 0; i < min_t(int, m->nr_args, MAX_BPF_FUNC_ARGS); i++) { + arg_regs =3D (m->arg_size[i] + 7) / 8; + + if (nr_regs + arg_regs > MAX_REGS_FOR_ARGS && + m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) + return -ENOTSUPP; + nr_regs +=3D arg_regs; + } + + /* x86-64 supports up to MAX_BPF_FUNC_ARGS arguments. 1-6 + * are passed through regs, the remains are through stack. + */ + if (nr_regs > MAX_BPF_FUNC_ARGS) + return -ENOTSUPP; + + + return 0; +} + /* mov rax, qword ptr [rbp - rounded_stack_depth - 8] */ #define LOAD_TRAMP_TAIL_CALL_CNT_PTR(stack) \ __LOAD_TCC_PTR(-round_up(stack, 8) - 8) @@ -3089,18 +3112,19 @@ static int __arch_prepare_bpf_trampoline(struct bpf= _tramp_image *im, void *rw_im WARN_ON_ONCE((flags & BPF_TRAMP_F_INDIRECT) && (flags & ~(BPF_TRAMP_F_INDIRECT | BPF_TRAMP_F_RET_FENTRY_RET))); =20 + /* make sure that any argument can be located and processed by the + * trampoline + */ + ret =3D validate_args(m); + if (ret) + return ret; + /* extra registers for struct arguments */ for (i =3D 0; i < m->nr_args; i++) { if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) nr_regs +=3D (m->arg_size[i] + 7) / 8 - 1; } =20 - /* x86-64 supports up to MAX_BPF_FUNC_ARGS arguments. 1-6 - * are passed through regs, the remains are through stack. - */ - if (nr_regs > MAX_BPF_FUNC_ARGS) - return -ENOTSUPP; - /* Generated trampoline stack layout: * * RBP + 8 [ return address ] --=20 2.49.0 From nobody Fri Oct 10 16:01:09 2025 Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53BE02F2C49; Fri, 13 Jun 2025 07:37:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.183.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800262; cv=none; b=YBE/WLE8ZshQEok3T8Mi3v2WOij60RueKMm9KDYqZp55SNaBEoarN2+4ww6RvmPqkTzORu9UR/L/sAHVjVaie93HV63pW8MIKXAohSFmfHgMgDiTQ5g2s4GrmkgAWaqTCAglnVAxrvw9Y4qw8RHH4kC+uqS4NCHCe/8cjRTWCr0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800262; c=relaxed/simple; bh=X3/qNFrhRreT64m2S7ky/c4+A/JzChsq4eXa99Zhu/w=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ji96+Ocg4aSbSF9kkxKq51orl80eOTnCfzjWjzT9ZQo4nLFxSVwj+Iutb7bf69jCzA+W5PqixggN9m6VGbBeqz99ri4qvVvnvU7EKsJPdGNAabDHpUdPmsPAAQwb0HAY05KASa45ed6PY/uEcQhNg8ran74pMESdwEbYDILmUXA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=fYTs9Jbt; arc=none smtp.client-ip=217.70.183.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="fYTs9Jbt" Received: by mail.gandi.net (Postfix) with ESMTPSA id 4737044515; Fri, 13 Jun 2025 07:37:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1749800257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WLtF15o+Ex4Ed3vWHcKorxdQYUZ/IggFlAe1+Bvb1bQ=; b=fYTs9JbtnbQa0LG78Ip8By4e8kxfeBYaAkBZGd4wF2a4/6esqJ7MVj2PbEj1VGMwdzrKHn 7XSJaqODDAiuBQDbcyOJ7ITyuZE+Zts95dmJNmUCOudt2D1o/fCHsHwfW7ERCyNo9O1egn /LwdsL+26wj2ktOlxMEyz4YwoQPhxWG3YI5wtVxeYPnSz7g19gMYyM6asNdvVsnq2m9Nud WCK4DjKtHb+62+sqH6m5ov7tSnrcJSJbY8GgNj68E54TrE24BXl7RVaYv4PAxT+EIQDmaB TM9B8Eacu+Xd3qzw1RWvru499qrPa8XL5GB3APEztX4F4YDKWoL4Z2Ne93qTdQ== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Fri, 13 Jun 2025 09:37:12 +0200 Subject: [PATCH bpf 3/7] bpf/riscv: prevent trampoline attachment when args location on stack is uncertain Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250613-deny_trampoline_structs_on_stack-v1-3-5be9211768c3@bootlin.com> References: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> In-Reply-To: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Menglong Dong , =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , Pu Lehui , Puranjay Mohan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Hari Bathini , Christophe Leroy , Naveen N Rao , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Mykola Lysenko , Shuah Khan , Maxime Coquelin , Alexandre Torgue Cc: ebpf@linuxfoundation.org, Thomas Petazzoni , Bastien Curutchet , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.14.2 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtddugddujeefjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephfffufggtgfgkfhfjgfvvefosehtkeertdertdejnecuhfhrohhmpeetlhgvgihishcunfhothhhohhrroculdgvuefrhfcuhfhouhhnuggrthhiohhnmdcuoegrlhgvgihishdrlhhothhhohhrvgessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnhepleejkeetffefveelgeeklefhtefhgfeigeduveffjeehleeifeefjedtudejgeeunecukfhppedvrgdtvdemkeegvdekmehfleegtgemvgdttdemmehfkeehnecuvehluhhsthgvrhfuihiivgepudenucfrrghrrghmpehinhgvthepvdgrtddvmeekgedvkeemfhelgegtmegvtddtmeemfhekhedphhgvlhhopegludelvddrudeikedruddrudeljegnpdhmrghilhhfrhhomheprghlvgigihhsrdhlohhthhhorhgvsegsohhothhlihhnrdgtohhmpdhnsggprhgtphhtthhopeehkedprhgtphhtthhopehsohhngheskhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprghgohhruggvvghvsehlihhnuhigrdhisghmrdgtohhmpdhrtghpthhtoheplhhinhhugihpphgtqdguvghvsehlihhsthhsrdhoiihlrggsshdrohhrghdprhgtphhtthhopehlihhnuhigq dhkshgvlhhfthgvshhtsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqshhtmhefvdesshhtqdhmugdqmhgrihhlmhgrnhdrshhtohhrmhhrvghplhihrdgtohhmpdhrtghpthhtoheprghlvgigrghnughrvgdrthhorhhguhgvsehfohhsshdrshhtrdgtohhmpdhrtghpthhtohepmhihkhholhgrlhesfhgsrdgtohhmpdhrtghpthhtohepshhvvghnsheslhhinhhugidrihgsmhdrtghomh X-GND-Sasl: alexis.lothore@bootlin.com When the target function receives more arguments than available registers, the additional arguments are passed on stack, and so the generated trampoline needs to read those to prepare the bpf context, but also to prepare the target function stack when it is in charge of calling it. This works well for scalar types, but if the value is a struct, we can not know for sure the exact struct location, as it may have been packed or manually aligned to a greater value. Prevent wrong readings by refusing trampoline attachment if the target function receives a struct on stack. While at it, move the max bpf args check in the new function. Fixes: 6801b0aef79d ("riscv, bpf: Add 12-argument support for RV64 bpf tram= poline") Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/riscv/net/bpf_jit_comp64.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp6= 4.c index 10e01ff06312d9f1e6e213bb069c6ea749ea9af2..ea3a1c3af6bc129057c16a4070c= 33dbf00e6c611 100644 --- a/arch/riscv/net/bpf_jit_comp64.c +++ b/arch/riscv/net/bpf_jit_comp64.c @@ -1005,6 +1005,24 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l,= int args_off, int retval_of return ret; } =20 +static int validate_args(const struct btf_func_model *m) +{ + int i, nr_arg_slots, nr_regs =3D 0; + + if (m->nr_args > MAX_BPF_FUNC_ARGS) + return -ENOTSUPP; + + for (i =3D 0; i < m->nr_args; i++) { + nr_arg_slots =3D round_up(m->arg_size[i], 8) / 8; + if (nr_regs + nr_arg_slots > RV_MAX_REG_ARGS && + m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) + return -ENOTSUPP; + nr_regs +=3D nr_arg_slots; + } + + return 0; +} + static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, const struct btf_func_model *m, struct bpf_tramp_links *tlinks, @@ -1069,8 +1087,12 @@ static int __arch_prepare_bpf_trampoline(struct bpf_= tramp_image *im, if (flags & (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY)) return -ENOTSUPP; =20 - if (m->nr_args > MAX_BPF_FUNC_ARGS) - return -ENOTSUPP; + /* make sure that any argument can be located and processed by the + * trampoline + */ + ret =3D validate_args(m); + if (ret) + return ret; =20 for (i =3D 0; i < m->nr_args; i++) nr_arg_slots +=3D round_up(m->arg_size[i], 8) / 8; --=20 2.49.0 From nobody Fri Oct 10 16:01:09 2025 Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DB9F3DABE3; Fri, 13 Jun 2025 07:37:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.183.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800266; cv=none; b=hpP+yohiqQSjoTmC8o1AvfwsOLxIw+L9NwwjkCjKbW2NayJXsBAaYJADGTbxLyyTkRDrN0B3CIqFw1T3uPVBL83TMmZ7LRdmjA7O8FE2vGUB10t4R4gt31u6ZYdFmud3XdQRIg9VqbBrJV22EUxQ+LQOzNUVctZu/n+TnCpe384= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800266; c=relaxed/simple; bh=vtKxNMQ6gJ2JlF1RXe+Fzar4sjRw68Vcwy6y8vb5qGc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Xo7GZTNnTqLRZxs3Oq9SsU6CkIQ9CIY0oThvy9RqCax0fOVSK8ZgmZVcRfNQ1fZN1Wd77Zf8DHidbEyR5jnh4Xcy1hSmJwgEvvwuyTnIfn3EBqI42YbC/DkNgC6Vcf27nJlq/cux5tdqoDuq6enkz95WEoTe5pZNuYR1TTcb5Gs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=kvD2hrpD; arc=none smtp.client-ip=217.70.183.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="kvD2hrpD" Received: by mail.gandi.net (Postfix) with ESMTPSA id 88A9C44516; Fri, 13 Jun 2025 07:37:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1749800260; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AE8ksX7Iai+R1M5VXIrdzL2o9dpfxU46gR1hgNGIp3g=; b=kvD2hrpD62fIseyftMWMe0jHM9CAcsYLN8R7Xc6MonWGBLp7j1sio+s3HcvX7iPfzC/8h8 getABYjlm0kibtX6MId+UBJ9HmyRY30O6f5FyYUYWuUd8PDdov6JURNzzP4S+uSdsJSv4q XEb+KK+3h6voonmJL7D85NyAtp25lNiRQMRalDJ3kPboHbjNLpH55lSoe5q2znNNkOnL81 8DtdUSstHOPVtwdZHqSvS3c5RAY9y45B+vRcTVgadBsa9GwE1sAcrWV87jhqCt7RWiB26X LiMUIN4BZaGLJ52spVpVwWII1yY7zWXf+/2MwJYIcUGxuNPNiZ1HJdUWRRohqg== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Fri, 13 Jun 2025 09:37:13 +0200 Subject: [PATCH bpf 4/7] bpf/s390: prevent trampoline attachment when args location on stack is uncertain Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250613-deny_trampoline_structs_on_stack-v1-4-5be9211768c3@bootlin.com> References: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> In-Reply-To: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Menglong Dong , =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , Pu Lehui , Puranjay Mohan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Hari Bathini , Christophe Leroy , Naveen N Rao , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Mykola Lysenko , Shuah Khan , Maxime Coquelin , Alexandre Torgue Cc: ebpf@linuxfoundation.org, Thomas Petazzoni , Bastien Curutchet , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.14.2 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtddugddujeefjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephfffufggtgfgkfhfjgfvvefosehtkeertdertdejnecuhfhrohhmpeetlhgvgihishcunfhothhhohhrroculdgvuefrhfcuhfhouhhnuggrthhiohhnmdcuoegrlhgvgihishdrlhhothhhohhrvgessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnhepleejkeetffefveelgeeklefhtefhgfeigeduveffjeehleeifeefjedtudejgeeunecukfhppedvrgdtvdemkeegvdekmehfleegtgemvgdttdemmehfkeehnecuvehluhhsthgvrhfuihiivgepfeenucfrrghrrghmpehinhgvthepvdgrtddvmeekgedvkeemfhelgegtmegvtddtmeemfhekhedphhgvlhhopegludelvddrudeikedruddrudeljegnpdhmrghilhhfrhhomheprghlvgigihhsrdhlohhthhhorhgvsegsohhothhlihhnrdgtohhmpdhnsggprhgtphhtthhopeehkedprhgtphhtthhopehsohhngheskhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprghgohhruggvvghvsehlihhnuhigrdhisghmrdgtohhmpdhrtghpthhtoheplhhinhhugihpphgtqdguvghvsehlihhsthhsrdhoiihlrggsshdrohhrghdprhgtphhtthhopehlihhnuhigq dhkshgvlhhfthgvshhtsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqshhtmhefvdesshhtqdhmugdqmhgrihhlmhgrnhdrshhtohhrmhhrvghplhihrdgtohhmpdhrtghpthhtoheprghlvgigrghnughrvgdrthhorhhguhgvsehfohhsshdrshhtrdgtohhmpdhrtghpthhtohepmhihkhholhgrlhesfhgsrdgtohhmpdhrtghpthhtohepshhvvghnsheslhhinhhugidrihgsmhdrtghomh X-GND-Sasl: alexis.lothore@bootlin.com When the target function receives more arguments than available registers, the additional arguments are passed on stack, and so the generated trampoline needs to read those to prepare the bpf context, but also to prepare the target function stack when it is in charge of calling it. This works well for scalar types, but if the value is a struct, we can not know for sure the exact struct location, as it may have been packed or manually aligned to a greater value. Prevent wrong readings by refusing trampoline attachment if the target function receives a struct on stack. While doing so, move the existing check (ensuring that the number of args passed on stack is not higher than MAX_NR_STACK_ARGS) into the newly created check function. Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/s390/net/bpf_jit_comp.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index c7f8313ba449716a8f18eafdeb6c77ed3b23f52e..b441feb20e993f54cc0e9a39c67= a726f4b61d9f2 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -2566,6 +2566,27 @@ static int alloc_stack(struct bpf_tramp_jit *tjit, s= ize_t size) /* -mfentry generates a 6-byte nop on s390x. */ #define S390X_PATCH_SIZE 6 =20 +static int validate_args(const struct btf_func_model *m) +{ + int i =3D 0, nr_reg_args, nr_stack_args; + + nr_reg_args =3D min_t(int, m->nr_args, MAX_NR_REG_ARGS); + nr_stack_args =3D m->nr_args - nr_reg_args; + + if (nr_stack_args =3D=3D 0) + return 0; + + /* Support as many stack arguments as "mvc" instruction can handle. */ + if (nr_stack_args > MAX_NR_STACK_ARGS) + return -ENOTSUPP; + + for (i =3D nr_reg_args; i < m->nr_args; i++) + if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) + return -ENOTSUPP; + + return 0; +} + static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, struct bpf_tramp_jit *tjit, const struct btf_func_model *m, @@ -2579,13 +2600,17 @@ static int __arch_prepare_bpf_trampoline(struct bpf= _tramp_image *im, int nr_bpf_args, nr_reg_args, nr_stack_args; struct bpf_jit *jit =3D &tjit->common; int arg, bpf_arg_off; - int i, j; + int i, j, ret; + + /* make sure that any argument can be located and processed by the + * trampoline + */ + ret =3D validate_args(m); + if (ret) + return ret; =20 - /* Support as many stack arguments as "mvc" instruction can handle. */ nr_reg_args =3D min_t(int, m->nr_args, MAX_NR_REG_ARGS); nr_stack_args =3D m->nr_args - nr_reg_args; - if (nr_stack_args > MAX_NR_STACK_ARGS) - return -ENOTSUPP; =20 /* Return to %r14 in the struct_ops case. */ if (flags & BPF_TRAMP_F_INDIRECT) --=20 2.49.0 From nobody Fri Oct 10 16:01:09 2025 Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4401A279DB0; Fri, 13 Jun 2025 07:37:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.183.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800268; cv=none; b=evXyOa6UsTzwylwHp1oa9IzrX6uIXpJs9dN4uCNLJ6nONYa2fZQXY7+COWpOXT5N2zAVqRydOXTqe1hrtCJ0Xbui5Z63lZ58SW/Rz/ZAVvo4pQUTQTAcWkODCNhQWXE7ddFcIEPlYfA05avkw/SwrRt2XhIxwa5HvKSHU+aLYiQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800268; c=relaxed/simple; bh=xUaD/nsPE2GIzcFHMYPMvnTmtq7voSyUCXhca+/WzNw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UftfqWy7mpQlf1ENBeDEvLTl/LX3k5GnVTokaBmN/6NgWlwMmYi7HzhQXQH4O8Z+sabePiAEHsTwS3UAlevT7f9gepMlr9SaJvIjUu626Ufc3liiQWP9GkblEOL7NRAns3V4CwKPEYZX1xMcvbLSLCoCkmOVcRWy3fgrqADnZSA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=PbUsx0ia; arc=none smtp.client-ip=217.70.183.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="PbUsx0ia" Received: by mail.gandi.net (Postfix) with ESMTPSA id A5C3D4451B; Fri, 13 Jun 2025 07:37:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1749800263; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eeLleyfYulrm7/2JkDlmDKQ+W0qM+PQ6c1Xd/a6HciU=; b=PbUsx0iacezWvrE6A20Xyl+42FRd0/58MVH7JIf9elFbkDG3eJJOpPGahhO/fOwo06e7Gb v1In1Q/JhMx10WL0FVaMQLv8yM7qi6hl4gjHJBEBAadUl1AlxaXU/7UanahRe8NY82lPHT RIaBdWnX4B0AsjT9RnzYiuAtLL1q9vrkkVxg0R0brkQ9Wd4kPpfHCimyNG1cFEFCLp+eo+ aZJ1YSyI68DwRMuA/gSfC4kdCpB5pK58wK19PUAQ6eYzrFh0n+serqJ33z6xPgAI6tCkyK jpHHzO+7YONhWsDauoIHYDC0ETlCR6ocSRSRHBCtmX/Qt7CSafBTpS9Q9PAfjQ== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Fri, 13 Jun 2025 09:37:14 +0200 Subject: [PATCH bpf 5/7] bpf/powerpc64: use define for max regs count used for arguments Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250613-deny_trampoline_structs_on_stack-v1-5-5be9211768c3@bootlin.com> References: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> In-Reply-To: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Menglong Dong , =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , Pu Lehui , Puranjay Mohan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Hari Bathini , Christophe Leroy , Naveen N Rao , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Mykola Lysenko , Shuah Khan , Maxime Coquelin , Alexandre Torgue Cc: ebpf@linuxfoundation.org, Thomas Petazzoni , Bastien Curutchet , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.14.2 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtddugddujeefjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephfffufggtgfgkfhfjgfvvefosehtkeertdertdejnecuhfhrohhmpeetlhgvgihishcunfhothhhohhrroculdgvuefrhfcuhfhouhhnuggrthhiohhnmdcuoegrlhgvgihishdrlhhothhhohhrvgessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnhepleejkeetffefveelgeeklefhtefhgfeigeduveffjeehleeifeefjedtudejgeeunecukfhppedvrgdtvdemkeegvdekmehfleegtgemvgdttdemmehfkeehnecuvehluhhsthgvrhfuihiivgepfeenucfrrghrrghmpehinhgvthepvdgrtddvmeekgedvkeemfhelgegtmegvtddtmeemfhekhedphhgvlhhopegludelvddrudeikedruddrudeljegnpdhmrghilhhfrhhomheprghlvgigihhsrdhlohhthhhorhgvsegsohhothhlihhnrdgtohhmpdhnsggprhgtphhtthhopeehkedprhgtphhtthhopehsohhngheskhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprghgohhruggvvghvsehlihhnuhigrdhisghmrdgtohhmpdhrtghpthhtoheplhhinhhugihpphgtqdguvghvsehlihhsthhsrdhoiihlrggsshdrohhrghdprhgtphhtthhopehlihhnuhigq dhkshgvlhhfthgvshhtsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqshhtmhefvdesshhtqdhmugdqmhgrihhlmhgrnhdrshhtohhrmhhrvghplhihrdgtohhmpdhrtghpthhtoheprghlvgigrghnughrvgdrthhorhhguhgvsehfohhsshdrshhtrdgtohhmpdhrtghpthhtohepmhihkhholhgrlhesfhgsrdgtohhmpdhrtghpthhtohepshhvvghnsheslhhinhhugidrihgsmhdrtghomh X-GND-Sasl: alexis.lothore@bootlin.com powerpc allows using up to 8 registers to pass arguments between function calls. This value is hardcoded in multiple places, use a define for this value. Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/powerpc/net/bpf_jit_comp.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_com= p.c index c0684733e9d6ac79b4cf653bf1b9ad40eb3e1aca..d313920a42c2310c6b5deab6d82= e13af49c8ecb1 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -22,6 +22,8 @@ =20 #include "bpf_jit.h" =20 +#define MAX_REGS_FOR_ARGS 8 + /* These offsets are from bpf prog end and stay the same across progs */ static int bpf_jit_ool_stub, bpf_jit_long_branch_stub; =20 @@ -613,7 +615,7 @@ static void bpf_trampoline_save_args(u32 *image, struct= codegen_context *ctx, in param_save_area_offset +=3D STACK_FRAME_MIN_SIZE; /* param save area is p= ast frame header */ =20 for (int i =3D 0; i < nr_regs; i++) { - if (i < 8) { + if (i < MAX_REGS_FOR_ARGS) { EMIT(PPC_RAW_STL(_R3 + i, _R1, regs_off + i * SZL)); } else { EMIT(PPC_RAW_LL(_R3, _R1, param_save_area_offset + i * SZL)); @@ -626,7 +628,7 @@ static void bpf_trampoline_save_args(u32 *image, struct= codegen_context *ctx, in static void bpf_trampoline_restore_args_regs(u32 *image, struct codegen_co= ntext *ctx, int nr_regs, int regs_off) { - for (int i =3D 0; i < nr_regs && i < 8; i++) + for (int i =3D 0; i < nr_regs && i < MAX_REGS_FOR_ARGS; i++) EMIT(PPC_RAW_LL(_R3 + i, _R1, regs_off + i * SZL)); } =20 @@ -725,7 +727,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tra= mp_image *im, void *rw_im * * Reserve space for at least 8 registers for now. This can be optimized = later. */ - bpf_frame_size +=3D (nr_regs > 8 ? nr_regs : 8) * SZL; + bpf_frame_size +=3D + (nr_regs > MAX_REGS_FOR_ARGS ? nr_regs : MAX_REGS_FOR_ARGS) * + SZL; =20 /* Room for struct bpf_tramp_run_ctx */ run_ctx_off =3D bpf_frame_size; --=20 2.49.0 From nobody Fri Oct 10 16:01:09 2025 Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 505382BF016; Fri, 13 Jun 2025 07:37:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.183.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800271; cv=none; b=BurOnA2pkeBAxob1ZGH5By/gsK1NbSZG93zwTzjafDcNQ08kmSIG5VFYaEm5drgcqVeUnxQY9C6NQ9W/H7bfhDidKi8MxDUZgGd5mJzrHV5uPTi+C6z/gV3w415NJOElN3GIJ0V/1D5jIYJgLKk1CEKb4Vg6szWR9nBQKUNmZYs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800271; c=relaxed/simple; bh=r9oDKIdJ12uqLzi3NoMHxmuNO+h431dGK6BCCJSF6v4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=fgOivWYFCQVUnaAZf193KYrl0ulCtq7kAI5aFAdr53fBAAV8uuorJq5XCn7EehzOL1hEXRHtHJEvQyGHzHfpdwTMERovDraGuafHNFHTrPqMma1XfyRo1YOLc2bb8EirEwHcJT2qNmXCdAR4iYbkt3PO0cdlczGYXs+pKWuOwB4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=dwebunOK; arc=none smtp.client-ip=217.70.183.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="dwebunOK" Received: by mail.gandi.net (Postfix) with ESMTPSA id BEC8444521; Fri, 13 Jun 2025 07:37:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1749800266; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hKtkaErlksV8Vai/mKr2KqKy0M00KlPerZSqFi6ERyQ=; b=dwebunOKGliUOBu0dNuEzYlEobxLghh6N2AjWZRVOv7pySHnZ4d90y3u/LKtoLu/V3/LfP 2KiFKa2Y0NEQldNzq3K71KBjpIjMQI1puCXBRaFQo7HCyQkh2gTujOhu67NHiEeLBb1DF1 BPYsOl4mfk7z7+G5sHARa5gXMvyImzjZDetFx+lZny8idRUIrudoAxb3Y1NTVEefG4NQCz 6ZbGLS+MmTGkdgFGSJY9hMfB0KAavEySPzPqdMYT8Gr0dOjwNLA5KFoIs1ibbeMRPL3EdA HQg1LeNMpm2RaUfwjAMZ1ai3nQJE4grrAFbz0KzRPMp0sg9141N7Zje4pN6WNg== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Fri, 13 Jun 2025 09:37:15 +0200 Subject: [PATCH bpf 6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250613-deny_trampoline_structs_on_stack-v1-6-5be9211768c3@bootlin.com> References: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> In-Reply-To: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Menglong Dong , =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , Pu Lehui , Puranjay Mohan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Hari Bathini , Christophe Leroy , Naveen N Rao , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Mykola Lysenko , Shuah Khan , Maxime Coquelin , Alexandre Torgue Cc: ebpf@linuxfoundation.org, Thomas Petazzoni , Bastien Curutchet , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.14.2 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtddugddujeefjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephfffufggtgfgkfhfjgfvvefosehtkeertdertdejnecuhfhrohhmpeetlhgvgihishcunfhothhhohhrroculdgvuefrhfcuhfhouhhnuggrthhiohhnmdcuoegrlhgvgihishdrlhhothhhohhrvgessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnhepleejkeetffefveelgeeklefhtefhgfeigeduveffjeehleeifeefjedtudejgeeunecukfhppedvrgdtvdemkeegvdekmehfleegtgemvgdttdemmehfkeehnecuvehluhhsthgvrhfuihiivgepheenucfrrghrrghmpehinhgvthepvdgrtddvmeekgedvkeemfhelgegtmegvtddtmeemfhekhedphhgvlhhopegludelvddrudeikedruddrudeljegnpdhmrghilhhfrhhomheprghlvgigihhsrdhlohhthhhorhgvsegsohhothhlihhnrdgtohhmpdhnsggprhgtphhtthhopeehkedprhgtphhtthhopehsohhngheskhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprghgohhruggvvghvsehlihhnuhigrdhisghmrdgtohhmpdhrtghpthhtoheplhhinhhugihpphgtqdguvghvsehlihhsthhsrdhoiihlrggsshdrohhrghdprhgtphhtthhopehlihhnuhigq dhkshgvlhhfthgvshhtsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqshhtmhefvdesshhtqdhmugdqmhgrihhlmhgrnhdrshhtohhrmhhrvghplhihrdgtohhmpdhrtghpthhtoheprghlvgigrghnughrvgdrthhorhhguhgvsehfohhsshdrshhtrdgtohhmpdhrtghpthhtohepmhihkhholhgrlhesfhgsrdgtohhmpdhrtghpthhtohepshhvvghnsheslhhinhhugidrihgsmhdrtghomh X-GND-Sasl: alexis.lothore@bootlin.com When the target function receives more arguments than available registers, the additional arguments are passed on stack, and so the generated trampoline needs to read those to prepare the bpf context, but also to prepare the target function stack when it is in charge of calling it. This works well for scalar types, but if the value is a struct, we can not know for sure the exact struct location, as it may have been packed or manually aligned to a greater value. Prevent wrong readings by refusing trampoline attachment if the target function receives a struct on stack. While at it, move the max bpf args check in the new function. Fixes: d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines") Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/powerpc/net/bpf_jit_comp.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_com= p.c index d313920a42c2310c6b5deab6d82e13af49c8ecb1..97f5209a25adb4865e3cc342292= c8f15b1985156 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -648,6 +648,24 @@ static void bpf_trampoline_restore_args_stack(u32 *ima= ge, struct codegen_context bpf_trampoline_restore_args_regs(image, ctx, nr_regs, regs_off); } =20 +static int validate_args(const struct btf_func_model *m) +{ + int nr_regs =3D m->nr_args, i; + + for (i =3D 0; i < m->nr_args; i++) { + if (m->arg_size[i] > SZL) + nr_regs +=3D round_up(m->arg_size[i], SZL) / SZL - 1; + if (i > MAX_REGS_FOR_ARGS && + m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) + return -ENOTSUPP; + } + + if (nr_regs > MAX_BPF_FUNC_ARGS) + return -ENOTSUPP; + + return 0; +} + static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void = *rw_image, void *rw_image_end, void *ro_image, const struct btf_func_model *m, u32 flags, @@ -668,15 +686,19 @@ static int __arch_prepare_bpf_trampoline(struct bpf_t= ramp_image *im, void *rw_im if (IS_ENABLED(CONFIG_PPC32)) return -EOPNOTSUPP; =20 + /* make sure that any argument can be located and processed by the + * trampoline + */ + ret =3D validate_args(m); + if (ret) + return ret; + nr_regs =3D m->nr_args; /* Extra registers for struct arguments */ for (i =3D 0; i < m->nr_args; i++) if (m->arg_size[i] > SZL) nr_regs +=3D round_up(m->arg_size[i], SZL) / SZL - 1; =20 - if (nr_regs > MAX_BPF_FUNC_ARGS) - return -EOPNOTSUPP; - ctx =3D &codegen_ctx; memset(ctx, 0, sizeof(*ctx)); =20 --=20 2.49.0 From nobody Fri Oct 10 16:01:09 2025 Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FA022C1592; Fri, 13 Jun 2025 07:37:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.183.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800274; cv=none; b=Yc1NghstjQbxNBDIOeAVROyu8yD9bLk6JmWaO+trVSRWFzlH/OvBlv0Xw7BmgYg6gy99v15np17OI1dk9ruY8arjROTErN/9u8TNDBEXeE7XlE8tuP7ZOfZlHKbhgT+TP8WXIkWOJdcG5gLmzfVlRzGDP3bFHwDahjbeu4E6WAE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749800274; c=relaxed/simple; bh=iIMnlztpXbwcWbgSXSXbcP68yXrt705uKF/GhI8NV24=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=tUbdR8gXzbxHWmioRC1L+eefOyE3ivnS9wW+XQYEdxwsO0g6OMKTdgWH2y1Y7roI+FN1OzqQKXOF1GxIMTd2ZdlKLVAvvdya9sW1d7xSsKWgdYd1ipR7X65yMfYkTo/AfzVZi3s2FdSTmjkdQ7/8g98M7E3U7T5I33ha0yHxBl0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=DF3THJ1s; arc=none smtp.client-ip=217.70.183.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="DF3THJ1s" Received: by mail.gandi.net (Postfix) with ESMTPSA id D4598444FF; Fri, 13 Jun 2025 07:37:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1749800269; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iCXQsbKGx+Ub2FZUU4QMyCt/kow3TrN3wSQz5BFCUkM=; b=DF3THJ1s5ZoAGCH1tZpg/RgBTuqlcD8+Gdp1vl6l3EZKPdA2tmFvAy1qMrIUlDHacBw4me MFS+0Sj5NOI/giQFNCWdzjxRiAp4lUkXcxkcSwknp830UZbsZnCfr+63KS5svSG/F5+h0x Xe5wnzxSG36kWva694mtZMJYDhN2O8YZ+YXrJGUBk2ss876kL+FBbj0adn2daygE8jAO8P H+0jdrFMZscJazoKecvPWyiAYqc3a/B78GATwVOa9kkr33jFZTIMZlD3JELF5jRjxklPRm 9bQZmKQvEyDNn6uS2dJ9g/6g/dFX2YDKHhe3YqOf6hSrWJxpe6km0MRjuTq7Vg== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Fri, 13 Jun 2025 09:37:16 +0200 Subject: [PATCH bpf 7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250613-deny_trampoline_structs_on_stack-v1-7-5be9211768c3@bootlin.com> References: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> In-Reply-To: <20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Menglong Dong , =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , Pu Lehui , Puranjay Mohan , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Hari Bathini , Christophe Leroy , Naveen N Rao , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Mykola Lysenko , Shuah Khan , Maxime Coquelin , Alexandre Torgue Cc: ebpf@linuxfoundation.org, Thomas Petazzoni , Bastien Curutchet , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Bj=C3=B6rn_T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.14.2 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtddugddujeefjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfitefpfffkpdcuggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephfffufggtgfgkfhfjgfvvefosehtkeertdertdejnecuhfhrohhmpeetlhgvgihishcunfhothhhohhrroculdgvuefrhfcuhfhouhhnuggrthhiohhnmdcuoegrlhgvgihishdrlhhothhhohhrvgessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnhepleejkeetffefveelgeeklefhtefhgfeigeduveffjeehleeifeefjedtudejgeeunecukfhppedvrgdtvdemkeegvdekmehfleegtgemvgdttdemmehfkeehnecuvehluhhsthgvrhfuihiivgepheenucfrrghrrghmpehinhgvthepvdgrtddvmeekgedvkeemfhelgegtmegvtddtmeemfhekhedphhgvlhhopegludelvddrudeikedruddrudeljegnpdhmrghilhhfrhhomheprghlvgigihhsrdhlohhthhhorhgvsegsohhothhlihhnrdgtohhmpdhnsggprhgtphhtthhopeehkedprhgtphhtthhopehsohhngheskhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprghgohhruggvvghvsehlihhnuhigrdhisghmrdgtohhmpdhrtghpthhtoheplhhinhhugihpphgtqdguvghvsehlihhsthhsrdhoiihlrggsshdrohhrghdprhgtphhtthhopehlihhnuhigq dhkshgvlhhfthgvshhtsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqshhtmhefvdesshhtqdhmugdqmhgrihhlmhgrnhdrshhtohhrmhhrvghplhihrdgtohhmpdhrtghpthhtoheprghlvgigrghnughrvgdrthhorhhguhgvsehfohhsshdrshhtrdgtohhmpdhrtghpthhtohepmhihkhholhgrlhesfhgsrdgtohhmpdhrtghpthhtohepshhvvghnsheslhhinhhugidrihgsmhdrtghomh X-GND-Sasl: alexis.lothore@bootlin.com When attaching ebpf programs to functions through fentry/fexit, the generated trampolines can not really make sure about the arguments exact location on the stack if those are structures: those structures can be altered with attributes such as packed or aligned(x), but this information is not encoded in BTF. Update tracing_struct_many_args test to check that programs can not be attached on those specific functions. Not all architectures can use the same number of registers to pass arguments, so define a testing function that makes all currently supported architectures start passing arguments on stack (-> more than 8 args) Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- .../selftests/bpf/prog_tests/tracing_struct.c | 37 +----------- .../selftests/bpf/progs/tracing_struct_many_args.c | 70 ------------------= ---- .../testing/selftests/bpf/test_kmods/bpf_testmod.c | 43 ++----------- 3 files changed, 6 insertions(+), 144 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/tracing_struct.c b/tool= s/testing/selftests/bpf/prog_tests/tracing_struct.c index 19e68d4b353278bf8e2917e62f62c89d14d7fe80..a084f6e5eca4e97b463950feba2= 142a628e9ec72 100644 --- a/tools/testing/selftests/bpf/prog_tests/tracing_struct.c +++ b/tools/testing/selftests/bpf/prog_tests/tracing_struct.c @@ -70,44 +70,9 @@ static void test_struct_many_args(void) return; =20 err =3D tracing_struct_many_args__attach(skel); - if (!ASSERT_OK(err, "tracing_struct_many_args__attach")) + if (!ASSERT_EQ(err, -ENOTSUPP, "tracing_struct_many_args__attach")) goto destroy_skel; =20 - ASSERT_OK(trigger_module_test_read(256), "trigger_read"); - - ASSERT_EQ(skel->bss->t7_a, 16, "t7:a"); - ASSERT_EQ(skel->bss->t7_b, 17, "t7:b"); - ASSERT_EQ(skel->bss->t7_c, 18, "t7:c"); - ASSERT_EQ(skel->bss->t7_d, 19, "t7:d"); - ASSERT_EQ(skel->bss->t7_e, 20, "t7:e"); - ASSERT_EQ(skel->bss->t7_f_a, 21, "t7:f.a"); - ASSERT_EQ(skel->bss->t7_f_b, 22, "t7:f.b"); - ASSERT_EQ(skel->bss->t7_ret, 133, "t7 ret"); - - ASSERT_EQ(skel->bss->t8_a, 16, "t8:a"); - ASSERT_EQ(skel->bss->t8_b, 17, "t8:b"); - ASSERT_EQ(skel->bss->t8_c, 18, "t8:c"); - ASSERT_EQ(skel->bss->t8_d, 19, "t8:d"); - ASSERT_EQ(skel->bss->t8_e, 20, "t8:e"); - ASSERT_EQ(skel->bss->t8_f_a, 21, "t8:f.a"); - ASSERT_EQ(skel->bss->t8_f_b, 22, "t8:f.b"); - ASSERT_EQ(skel->bss->t8_g, 23, "t8:g"); - ASSERT_EQ(skel->bss->t8_ret, 156, "t8 ret"); - - ASSERT_EQ(skel->bss->t9_a, 16, "t9:a"); - ASSERT_EQ(skel->bss->t9_b, 17, "t9:b"); - ASSERT_EQ(skel->bss->t9_c, 18, "t9:c"); - ASSERT_EQ(skel->bss->t9_d, 19, "t9:d"); - ASSERT_EQ(skel->bss->t9_e, 20, "t9:e"); - ASSERT_EQ(skel->bss->t9_f, 21, "t9:f"); - ASSERT_EQ(skel->bss->t9_g, 22, "t9:f"); - ASSERT_EQ(skel->bss->t9_h_a, 23, "t9:h.a"); - ASSERT_EQ(skel->bss->t9_h_b, 24, "t9:h.b"); - ASSERT_EQ(skel->bss->t9_h_c, 25, "t9:h.c"); - ASSERT_EQ(skel->bss->t9_h_d, 26, "t9:h.d"); - ASSERT_EQ(skel->bss->t9_i, 27, "t9:i"); - ASSERT_EQ(skel->bss->t9_ret, 258, "t9 ret"); - destroy_skel: tracing_struct_many_args__destroy(skel); } diff --git a/tools/testing/selftests/bpf/progs/tracing_struct_many_args.c b= /tools/testing/selftests/bpf/progs/tracing_struct_many_args.c index 4742012ace06af949d7f15a21131aaef7ab006e4..1cbedcdc1c42e1fe2f118fdbd1a= 4ab7fe48b52fb 100644 --- a/tools/testing/selftests/bpf/progs/tracing_struct_many_args.c +++ b/tools/testing/selftests/bpf/progs/tracing_struct_many_args.c @@ -8,28 +8,11 @@ struct bpf_testmod_struct_arg_4 { int b; }; =20 -struct bpf_testmod_struct_arg_5 { - char a; - short b; - int c; - long d; -}; - -long t7_a, t7_b, t7_c, t7_d, t7_e, t7_f_a, t7_f_b, t7_ret; -long t8_a, t8_b, t8_c, t8_d, t8_e, t8_f_a, t8_f_b, t8_g, t8_ret; -long t9_a, t9_b, t9_c, t9_d, t9_e, t9_f, t9_g, t9_h_a, t9_h_b, t9_h_c, t9_= h_d, t9_i, t9_ret; =20 SEC("fentry/bpf_testmod_test_struct_arg_7") int BPF_PROG2(test_struct_many_args_1, __u64, a, void *, b, short, c, int,= d, void *, e, struct bpf_testmod_struct_arg_4, f) { - t7_a =3D a; - t7_b =3D (long)b; - t7_c =3D c; - t7_d =3D d; - t7_e =3D (long)e; - t7_f_a =3D f.a; - t7_f_b =3D f.b; return 0; } =20 @@ -37,59 +20,6 @@ SEC("fexit/bpf_testmod_test_struct_arg_7") int BPF_PROG2(test_struct_many_args_2, __u64, a, void *, b, short, c, int,= d, void *, e, struct bpf_testmod_struct_arg_4, f, int, ret) { - t7_ret =3D ret; - return 0; -} - -SEC("fentry/bpf_testmod_test_struct_arg_8") -int BPF_PROG2(test_struct_many_args_3, __u64, a, void *, b, short, c, int,= d, - void *, e, struct bpf_testmod_struct_arg_4, f, int, g) -{ - t8_a =3D a; - t8_b =3D (long)b; - t8_c =3D c; - t8_d =3D d; - t8_e =3D (long)e; - t8_f_a =3D f.a; - t8_f_b =3D f.b; - t8_g =3D g; - return 0; -} - -SEC("fexit/bpf_testmod_test_struct_arg_8") -int BPF_PROG2(test_struct_many_args_4, __u64, a, void *, b, short, c, int,= d, - void *, e, struct bpf_testmod_struct_arg_4, f, int, g, - int, ret) -{ - t8_ret =3D ret; return 0; } - -SEC("fentry/bpf_testmod_test_struct_arg_9") -int BPF_PROG2(test_struct_many_args_5, __u64, a, void *, b, short, c, int,= d, void *, e, - char, f, short, g, struct bpf_testmod_struct_arg_5, h, long, i) -{ - t9_a =3D a; - t9_b =3D (long)b; - t9_c =3D c; - t9_d =3D d; - t9_e =3D (long)e; - t9_f =3D f; - t9_g =3D g; - t9_h_a =3D h.a; - t9_h_b =3D h.b; - t9_h_c =3D h.c; - t9_h_d =3D h.d; - t9_i =3D i; - return 0; -} - -SEC("fexit/bpf_testmod_test_struct_arg_9") -int BPF_PROG2(test_struct_many_args_6, __u64, a, void *, b, short, c, int,= d, void *, e, - char, f, short, g, struct bpf_testmod_struct_arg_5, h, long, i, int= , ret) -{ - t9_ret =3D ret; - return 0; -} - char _license[] SEC("license") =3D "GPL"; diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/t= esting/selftests/bpf/test_kmods/bpf_testmod.c index e9e918cdf31ff2b15bf41302ad429e8683b834d6..ff6a4a0fb73679c6c4831ae0662= bce2080e53c23 100644 --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c @@ -55,13 +55,6 @@ struct bpf_testmod_struct_arg_4 { int b; }; =20 -struct bpf_testmod_struct_arg_5 { - char a; - short b; - int c; - long d; -}; - __bpf_hook_start(); =20 noinline int @@ -101,30 +94,10 @@ bpf_testmod_test_struct_arg_6(struct bpf_testmod_struc= t_arg_3 *a) { return bpf_testmod_test_struct_arg_result; } =20 -noinline int -bpf_testmod_test_struct_arg_7(u64 a, void *b, short c, int d, void *e, - struct bpf_testmod_struct_arg_4 f) -{ - bpf_testmod_test_struct_arg_result =3D a + (long)b + c + d + - (long)e + f.a + f.b; - return bpf_testmod_test_struct_arg_result; -} - -noinline int -bpf_testmod_test_struct_arg_8(u64 a, void *b, short c, int d, void *e, - struct bpf_testmod_struct_arg_4 f, int g) +noinline int bpf_testmod_test_struct_arg_7(u64 a, void *b, short c, int d, + void *e, u64 f, u64 g, u64 h, + struct bpf_testmod_struct_arg_4 i) { - bpf_testmod_test_struct_arg_result =3D a + (long)b + c + d + - (long)e + f.a + f.b + g; - return bpf_testmod_test_struct_arg_result; -} - -noinline int -bpf_testmod_test_struct_arg_9(u64 a, void *b, short c, int d, void *e, cha= r f, - short g, struct bpf_testmod_struct_arg_5 h, long i) -{ - bpf_testmod_test_struct_arg_result =3D a + (long)b + c + d + (long)e + - f + g + h.a + h.b + h.c + h.d + i; return bpf_testmod_test_struct_arg_result; } =20 @@ -397,7 +370,6 @@ bpf_testmod_test_read(struct file *file, struct kobject= *kobj, struct bpf_testmod_struct_arg_2 struct_arg2 =3D {2, 3}; struct bpf_testmod_struct_arg_3 *struct_arg3; struct bpf_testmod_struct_arg_4 struct_arg4 =3D {21, 22}; - struct bpf_testmod_struct_arg_5 struct_arg5 =3D {23, 24, 25, 26}; int i =3D 1; =20 while (bpf_testmod_return_ptr(i)) @@ -408,13 +380,8 @@ bpf_testmod_test_read(struct file *file, struct kobjec= t *kobj, (void)bpf_testmod_test_struct_arg_3(1, 4, struct_arg2); (void)bpf_testmod_test_struct_arg_4(struct_arg1, 1, 2, 3, struct_arg2); (void)bpf_testmod_test_struct_arg_5(); - (void)bpf_testmod_test_struct_arg_7(16, (void *)17, 18, 19, - (void *)20, struct_arg4); - (void)bpf_testmod_test_struct_arg_8(16, (void *)17, 18, 19, - (void *)20, struct_arg4, 23); - (void)bpf_testmod_test_struct_arg_9(16, (void *)17, 18, 19, (void *)20, - 21, 22, struct_arg5, 27); - + (void)bpf_testmod_test_struct_arg_7(16, (void *)17, 18, 19, (void *)20, + 21, 22, 23, struct_arg4); (void)bpf_testmod_test_arg_ptr_to_struct(&struct_arg1_2); =20 (void)trace_bpf_testmod_test_raw_tp_null_tp(NULL); --=20 2.49.0