A landing pad is about to start running outside its own frame, on the bpf_throw() walker's stack, with that frame's registers put back from a spill area whose contents arch_bpf_run_cleanup_pad() knows how to read. The x86-64 JIT addresses a private-stack program's frame through a scratch register that it recomputes after each call rather than through rbp, and no spill area holds that register, so a pad there would address its frame through whatever the kernel left behind. Refuse the combination in check_max_stack_depth(), where the choice is made. Everywhere rather than arch-conditionally: arm64 keeps its private stack pointer in x27, which is in the prologue spill and so survives, but a rule that holds on one arch and not the other is not worth the second code path when nothing is lost but an optimization. Signed-off-by: Yonghong Song --- kernel/bpf/verifier.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a3b34ded1392..43ecf79baa4a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5591,6 +5591,14 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) } } + /* + * A pad rebuilds its frame from a spill area, and on x86-64 a private + * stack's frame pointer is in no spill area. Refused on every arch + * rather than just that one. + */ + if (env->cleanup_info_cnt) + priv_stack_mode = NO_PRIV_STACK; + if (priv_stack_mode == PRIV_STACK_UNKNOWN) priv_stack_mode = bpf_enable_priv_stack(env->prog); -- 2.53.0-Meta