[bpf-next,v1,0/2] bpf: Fix array bounds error with may_goto and add selftest

Message

Jiayuan Chen Feb. 12, 2025, 1:52 p.m. UTC

Syzbot caught an array out-of-bounds bug [1]. It turns out that when the
BPF program runs through do_misc_fixups(), it allocates an extra 8 bytes
on the call stack, which eventually causes stack_depth to exceed 512.

I was able to reproduce this issue probabilistically by enabling
CONFIG_UBSAN=y and disabling CONFIG_BPF_JIT_ALWAYS_ON with the selfttest
I provide in second patch(although it doesn't happen every time - I didn't
dig deeper into why UBSAN behaves this way).

To fix this, I came up with three possible solutions:
1. Run check_max_stack_depth() again after do_misc_fixups(), but I don't
think it's fair to make users pay for the extra stack overhead caused by
our optimization. Especially when users write assembly code that directly
allocates 512 bytes (like my selftest), it's gonna fail and leave them
confused.

2. Force JIT when using may_goto, but that's not ideal if we want may_goto
to work with both interpreters and JIT.

3. Simply extend interpreters, which seems like the most reasonable
approach to me. And if I had to choose a second best, it would be option 1.


[1] https://syzkaller.appspot.com/bug?extid=d2a2c639d03ac200a4f1
---
Jiayuan Chen (2):
  bpf: Fix array bounds error with may_goto
  bpf/selftest: add selftest for may_goto

 kernel/bpf/core.c                             | 11 +++++--
 .../selftests/bpf/progs/verifier_stack_ptr.c  | 33 +++++++++++++++++++
 2 files changed, 41 insertions(+), 3 deletions(-)