An unwind resumes a frame at its landing pad rather than at the instruction after the call. On x86-64 that skips the pop which restores r9, where a private stack keeps its frame pointer -- the JIT brackets every call in push_r9/pop_r9 and the pad is reached before the pop runs. The pad would then address its frame through a stale pointer. Refused on every architecture rather than just that one. Force NO_PRIV_STACK in check_max_stack_depth(), where the choice is made. The subprograms below are then checked against MAX_BPF_STACK together rather than one at a time, so this can turn a program that would have loaded with a private stack into one that is too deep. Signed-off-by: Yonghong Song --- kernel/bpf/verifier.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index cc1ed776da15..677bab92f624 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5751,6 +5751,19 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) } } + /* + * An unwind resumes a frame at its landing pad rather than at the + * instruction after the call, and on x86-64 that skips the pop which + * restores r9 -- where a private stack keeps its frame pointer. The + * pad would address its frame through a stale one. Refused on every + * arch rather than just that one. The subprograms + * below are then checked against MAX_BPF_STACK together rather than + * one at a time, so this can turn a program that would have loaded + * with a private stack into one that is too deep. + */ + if (env->cleanup_info_cnt) + priv_stack_mode = NO_PRIV_STACK; + if (priv_stack_mode == PRIV_STACK_UNKNOWN) priv_stack_mode = bpf_enable_priv_stack(env->prog); -- 2.53.0-Meta