Skip to content

[PW_SID:971692] bpf: deny trampoline attachment if args can not be located exactly on stack#526

Closed
linux-riscv-bot wants to merge 8 commits into
workflow__riscv__fixesfrom
pw971692
Closed

[PW_SID:971692] bpf: deny trampoline attachment if args can not be located exactly on stack#526
linux-riscv-bot wants to merge 8 commits into
workflow__riscv__fixesfrom
pw971692

Conversation

@linux-riscv-bot
Copy link
Copy Markdown

PR for series 971692 applied to workflow__riscv__fixes

Name: bpf: deny trampoline attachment if args can not be located exactly on stack
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=971692
Version: 1

Linux RISC-V bot and others added 8 commits June 12, 2025 20:20
x86 allows using up to 6 registers to pass arguments between function
calls. This value is hardcoded in multiple places, use a define for this
value.

Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
… uncertain

When the target function receives more arguments than available
registers, the additional arguments are passed on stack, and so the
generated trampoline needs to read those to prepare the bpf context,
but also to prepare the target function stack when it is in charge of
calling it. This works well for scalar types, but if the value is a
struct, we can not know for sure the exact struct location, as it may
have been packed or manually aligned to a greater value.

Prevent wrong readings by refusing trampoline attachment if the target
function receives a struct on stack. While at it, move the max bpf args
check in the new function.

Fixes: 473e315 ("bpf, x86: allow function arguments up to 12 for TRACING")
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
…is uncertain

When the target function receives more arguments than available
registers, the additional arguments are passed on stack, and so the
generated trampoline needs to read those to prepare the bpf context, but
also to prepare the target function stack when it is in charge of
calling it. This works well for scalar types, but if the value is a
struct, we can not know for sure the exact struct location, as it may
have been packed or manually aligned to a greater value.

Prevent wrong readings by refusing trampoline attachment if the target
function receives a struct on stack. While at it, move the max bpf args
check in the new function.

Fixes: 6801b0a ("riscv, bpf: Add 12-argument support for RV64 bpf trampoline")
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
…s uncertain

When the target function receives more arguments than available
registers, the additional arguments are passed on stack, and so the
generated trampoline needs to read those to prepare the bpf context, but
also to prepare the target function stack when it is in charge of
calling it. This works well for scalar types, but if the value is a
struct, we can not know for sure the exact struct location, as it may
have been packed or manually aligned to a greater value.

Prevent wrong readings by refusing trampoline attachment if the target
function receives a struct on stack. While doing so, move the existing
check (ensuring that the number of args passed on stack is not higher
than MAX_NR_STACK_ARGS) into the newly created check function.

Fixes: 528eb2c ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
powerpc allows using up to 8 registers to pass arguments between function
calls. This value is hardcoded in multiple places, use a define for this
value.

Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
…ack is uncertain

When the target function receives more arguments than available
registers, the additional arguments are passed on stack, and so the
generated trampoline needs to read those to prepare the bpf context, but
also to prepare the target function stack when it is in charge of
calling it. This works well for scalar types, but if the value is a
struct, we can not know for sure the exact struct location, as it may
have been packed or manually aligned to a greater value.

Prevent wrong readings by refusing trampoline attachment if the target
function receives a struct on stack. While at it, move the max bpf args
check in the new function.

Fixes: d243b62 ("powerpc64/bpf: Add support for bpf trampolines")
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
… be hooked

When attaching ebpf programs to functions through fentry/fexit, the
generated trampolines can not really make sure about the arguments exact
location on the stack if those are structures: those structures can be
altered with attributes such as packed or aligned(x), but this
information is not encoded in BTF.

Update tracing_struct_many_args test to check that programs can not be
attached on those specific functions. Not all architectures can use the
same number of registers to pass arguments, so define a testing function
that makes all currently supported architectures start passing arguments
on stack (-> more than 8 args)

Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 101.02 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 913.53 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1229.94 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 20.56 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 21.20 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.75 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 70.63 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.25 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
kdoc
Desc: Detects for kdoc errors
Duration: 0.89 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
module-param
Desc: Detect module_param changes
Duration: 0.28 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.24 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 1: "[bpf,1/7] bpf/x86: use define for max regs count used for arguments"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.32 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 100.65 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 913.20 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1229.80 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 20.39 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 21.02 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 1.58 seconds
Result: WARNING
Output:

WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
#47: FILE: arch/x86/net/bpf_jit_comp.c:3013:
+			return -ENOTSUPP;

WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
#55: FILE: arch/x86/net/bpf_jit_comp.c:3021:
+		return -ENOTSUPP;

CHECK: Please don't use multiple blank lines
#57: FILE: arch/x86/net/bpf_jit_comp.c:3023:
+
+

total: 0 errors, 2 warnings, 1 checks, 54 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

Commit 61868a07606e ("bpf/x86: prevent trampoline attachment when args location on stack is uncertain") has style problems, please review.

NOTE: Ignored message types: ALLOC_SIZEOF_STRUCT CAMELCASE COMMIT_LOG_LONG_LINE GIT_COMMIT_ID MACRO_ARG_REUSE NO_AUTHOR_SIGN_OFF

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.
total: 0 errors, 2 warnings, 1 checks, 54 lines checked
CHECK: Please don't use multiple blank lines
WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP


@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 69.99 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.23 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
kdoc
Desc: Detects for kdoc errors
Duration: 0.82 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 2: "[bpf,2/7] bpf/x86: prevent trampoline attachment when args location on stack is uncertain"
module-param
Desc: Detect module_param changes
Duration: 0.25 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 5: "[bpf,5/7] bpf/powerpc64: use define for max regs count used for arguments"
module-param
Desc: Detect module_param changes
Duration: 0.24 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 5: "[bpf,5/7] bpf/powerpc64: use define for max regs count used for arguments"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.22 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 5: "[bpf,5/7] bpf/powerpc64: use define for max regs count used for arguments"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.31 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 99.96 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 911.64 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1232.62 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 19.92 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 21.66 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 1.53 seconds
Result: WARNING
Output:

WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
#47: FILE: arch/powerpc/net/bpf_jit_comp.c:660:
+			return -ENOTSUPP;

WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
#51: FILE: arch/powerpc/net/bpf_jit_comp.c:664:
+		return -ENOTSUPP;

total: 0 errors, 2 warnings, 0 checks, 46 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

Commit 21edd42aec90 ("bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain") has style problems, please review.

NOTE: Ignored message types: ALLOC_SIZEOF_STRUCT CAMELCASE COMMIT_LOG_LONG_LINE GIT_COMMIT_ID MACRO_ARG_REUSE NO_AUTHOR_SIGN_OFF

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.
total: 0 errors, 2 warnings, 0 checks, 46 lines checked
WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP


@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 70.92 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.23 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
kdoc
Desc: Detects for kdoc errors
Duration: 0.87 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
module-param
Desc: Detect module_param changes
Duration: 0.25 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.27 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 6: "[bpf,6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.30 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 100.35 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 912.69 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1231.50 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 20.25 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 21.60 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 2.12 seconds
Result: WARNING
Output:

WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
#40: FILE: tools/testing/selftests/bpf/prog_tests/tracing_struct.c:73:
+	if (!ASSERT_EQ(err, -ENOTSUPP, "tracing_struct_many_args__attach"))

total: 0 errors, 1 warnings, 0 checks, 200 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

Commit dfd9ca7b9c9d ("selftests/bpf: ensure that functions passing structs on stack can not be hooked") has style problems, please review.

NOTE: Ignored message types: ALLOC_SIZEOF_STRUCT CAMELCASE COMMIT_LOG_LONG_LINE GIT_COMMIT_ID MACRO_ARG_REUSE NO_AUTHOR_SIGN_OFF

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.
total: 0 errors, 1 warnings, 0 checks, 200 lines checked
WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP


@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 70.02 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.23 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
kdoc
Desc: Detects for kdoc errors
Duration: 0.86 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
module-param
Desc: Detect module_param changes
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.22 seconds
Result: PASS

@linux-riscv-bot
Copy link
Copy Markdown
Author

Patch 7: "[bpf,7/7] selftests/bpf: ensure that functions passing structs on stack can not be hooked"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.29 seconds
Result: PASS

@linux-riscv-bot linux-riscv-bot force-pushed the workflow__riscv__fixes branch from 8023d1f to 6ce2eef Compare June 20, 2025 17:17
@linux-riscv-bot linux-riscv-bot deleted the pw971692 branch June 21, 2025 01:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants