android_kernel_msm-6.1_noth.../kernel/bpf
Leon Hwang 605c8d8f99 bpf, x64: Fix tailcall infinite loop
[ Upstream commit 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 ]

From commit ebf7d1f508 ("bpf, x64: rework pro/epilogue and tailcall
handling in JIT"), the tailcall on x64 works better than before.

From commit e411901c0b ("bpf: allow for tailcalls in BPF subprograms
for x64 JIT"), tailcall is able to run in BPF subprograms on x64.

From commit 5b92a28aae ("bpf: Support attaching tracing BPF program
to other BPF programs"), BPF program is able to trace other BPF programs.

How about combining them all together?

1. FENTRY/FEXIT on a BPF subprogram.
2. A tailcall runs in the BPF subprogram.
3. The tailcall calls the subprogram's caller.

As a result, a tailcall infinite loop comes up. And the loop would halt
the machine.

As we know, in tail call context, the tail_call_cnt propagates by stack
and rax register between BPF subprograms. So do in trampolines.

Fixes: ebf7d1f508 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT")
Fixes: e411901c0b ("bpf: allow for tailcalls in BPF subprograms for x64 JIT")
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Leon Hwang <hffilwlqm@gmail.com>
Link: https://lore.kernel.org/r/20230912150442.2009-3-hffilwlqm@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-01-10 17:10:26 +01:00
..
preload bpf: iterators: Build and use lightweight bootstrap version of bpftool 2022-07-15 12:01:30 -07:00
arraymap.c bpf: Fix prog_array_map_poke_run map poke update 2024-01-01 12:38:52 +00:00
bloom_filter.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
bpf_inode_storage.c bpf: Compute map_btf_id during build time 2022-04-26 11:35:21 -07:00
bpf_iter.c bpf: Initialize the bpf_run_ctx in bpf_iter_run_prog() 2022-08-18 17:06:13 -07:00
bpf_local_storage.c bpf: Annotate data races in bpf_local_storage 2023-05-24 17:32:36 +01:00
bpf_lru_list.c bpf: Address KCSAN report on bpf_lru_list 2023-07-27 08:50:34 +02:00
bpf_lru_list.h bpf: Address KCSAN report on bpf_lru_list 2023-07-27 08:50:34 +02:00
bpf_lsm.c bpf: Fix the kernel crash caused by bpf_setsockopt(). 2023-02-09 11:28:02 +01:00
bpf_struct_ops.c bpf: Remove is_valid_bpf_tramp_flags() 2022-07-11 21:04:58 +02:00
bpf_struct_ops_types.h
bpf_task_storage.c bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy 2022-09-01 12:16:12 -07:00
btf.c bpf: Fix an error in verifying a field in a union 2023-09-13 09:42:30 +02:00
cgroup.c bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen 2023-07-19 16:21:05 +02:00
cgroup_iter.c cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers 2023-06-21 16:00:51 +02:00
core.c bpf: Detect IP == ksym.end as part of BPF program 2023-11-28 17:06:55 +00:00
cpumap.c bpf, cpumap: Make sure kthread is running before map update returns 2023-08-11 12:08:23 +02:00
devmap.c bpf: Use bpf_map_area_alloc consistently on bpf map creation 2022-08-10 11:50:43 -07:00
disasm.c
disasm.h
dispatcher.c bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE() 2022-11-07 16:07:35 -08:00
hashtab.c bpf: Fix unnecessary -EBUSY from htab_lock_bucket 2023-11-20 11:51:55 +01:00
helpers.c bpf: Check map->usercnt after timer->timer is assigned 2023-11-20 11:52:15 +01:00
inode.c
Kconfig rcu: Make the TASKS_RCU Kconfig option be selected 2022-04-20 16:52:58 -07:00
link_iter.c bpf: Add bpf_link iterator 2022-05-10 11:20:45 -07:00
local_storage.c cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers 2023-06-21 16:00:51 +02:00
lpm_trie.c bpf: Use bpf_map_area_alloc consistently on bpf map creation 2022-08-10 11:50:43 -07:00
Makefile bpf: Introduce any context BPF specific memory allocator. 2022-09-05 15:33:05 +02:00
map_in_map.c bpf: Fix elem_size not being set for inner maps 2023-06-14 11:15:17 +02:00
map_in_map.h
map_iter.c
memalloc.c bpf: Zeroing allocated object from slab in bpf memory allocator 2023-03-10 09:33:06 +01:00
mmap_unlock_work.h
net_namespace.c
offload.c bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD 2023-01-24 07:24:37 +01:00
percpu_freelist.c bpf: Initialize same number of free nodes for each pcpu_freelist 2022-11-11 12:05:14 -08:00
percpu_freelist.h
prog_iter.c
queue_stack_maps.c bpf: Avoid deadlock when using queue and stack maps from NMI 2023-10-06 14:56:35 +02:00
reuseport_array.c net: Fix suspicious RCU usage in bpf_sk_reuseport_detach() 2022-08-17 16:42:59 -07:00
ringbuf.c bpf: Add bpf_user_ringbuf_drain() helper 2022-09-21 16:24:58 -07:00
stackmap.c perf/bpf: Always use perf callchains if exist 2022-09-13 15:03:22 +02:00
syscall.c bpf: Assign bpf_tramp_run_ctx::saved_run_ctx before recursion check. 2023-09-19 12:28:03 +02:00
sysfs_btf.c
task_iter.c bpf: keep a reference to the mm, in case the task is dead. 2023-01-24 07:24:31 +01:00
tnum.c
trampoline.c bpf, x64: Fix tailcall infinite loop 2024-01-10 17:10:26 +01:00
verifier.c bpf, x64: Fix tailcall infinite loop 2024-01-10 17:10:26 +01:00