Commit 496720b7 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'Fix for check_max_stack_depth' 



Kumar Kartikeya Dwivedi says:

====================
Fix for a bug in check_max_stack_depth which allows bypassing the
512-byte stack limit.
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 68433066 906bd22a

kernel/bpf/verifier.c

+3 −2
Original line number Diff line number Diff line
@@ -5642,7 +5642,8 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) 
				verbose(env, "verifier bug. subprog has tail_call and async cb\n");

				return -EFAULT;

			}

			 /* async callbacks don't increase bpf prog stack size */

			/* async callbacks don't increase bpf prog stack size unless called directly */

			if (!bpf_pseudo_call(insn + i))

				continue;

		}

		i = next_insn;

tools/testing/selftests/bpf/prog_tests/async_stack_depth.c

0 → 100644
+9 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

#include <test_progs.h>



#include "async_stack_depth.skel.h"



void test_async_stack_depth(void)

{

	RUN_TESTS(async_stack_depth);

}

tools/testing/selftests/bpf/progs/async_stack_depth.c

0 → 100644
+40 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

#include <vmlinux.h>

#include <bpf/bpf_helpers.h>



#include "bpf_misc.h"



struct hmap_elem {

	struct bpf_timer timer;

};



struct {

	__uint(type, BPF_MAP_TYPE_HASH);

	__uint(max_entries, 64);

	__type(key, int);

	__type(value, struct hmap_elem);

} hmap SEC(".maps");



__attribute__((noinline))

static int timer_cb(void *map, int *key, struct bpf_timer *timer)

{

	volatile char buf[256] = {};

	return buf[69];

}



SEC("tc")

__failure __msg("combined stack size of 2 calls")

int prog(struct __sk_buff *ctx)

{

	struct hmap_elem *elem;

	volatile char buf[256] = {};



	elem = bpf_map_lookup_elem(&hmap, &(int){0});

	if (!elem)

		return 0;



	timer_cb(NULL, NULL, NULL);

	return bpf_timer_set_callback(&elem->timer, timer_cb) + buf[0];

}



char _license[] SEC("license") = "GPL";