[PATCH bpf 6/7] bpf/powerpc64: prevent trampoline attachment when args location on stack is uncertain

[eBPF Foundation]

When the target function receives more arguments than available
registers, the additional arguments are passed on stack, and so the
generated trampoline needs to read those to prepare the bpf context, but
also to prepare the target function stack when it is in charge of
calling it. This works well for scalar types, but if the value is a
struct, we can not know for sure the exact struct location, as it may
have been packed or manually aligned to a greater value.

Prevent wrong readings by refusing trampoline attachment if the target
function receives a struct on stack. While at it, move the max bpf args
check in the new function.

Fixes: d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines")
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.loth...@bootlin.com>
---
 arch/powerpc/net/bpf_jit_comp.c | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 
d313920a42c2310c6b5deab6d82e13af49c8ecb1..97f5209a25adb4865e3cc342292c8f15b1985156
 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -648,6 +648,24 @@ static void bpf_trampoline_restore_args_stack(u32 *image, 
struct codegen_context
        bpf_trampoline_restore_args_regs(image, ctx, nr_regs, regs_off);
 }
 
+static int validate_args(const struct btf_func_model *m)
+{
+       int nr_regs = m->nr_args, i;
+
+       for (i = 0; i < m->nr_args; i++) {
+               if (m->arg_size[i] > SZL)
+                       nr_regs += round_up(m->arg_size[i], SZL) / SZL - 1;
+               if (i > MAX_REGS_FOR_ARGS &&
+                   m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG)
+                       return -ENOTSUPP;
+       }
+
+       if (nr_regs > MAX_BPF_FUNC_ARGS)
+               return -ENOTSUPP;
+
+       return 0;
+}
+
 static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void 
*rw_image,
                                         void *rw_image_end, void *ro_image,
                                         const struct btf_func_model *m, u32 
flags,
@@ -668,15 +686,19 @@ static int __arch_prepare_bpf_trampoline(struct 
bpf_tramp_image *im, void *rw_im
        if (IS_ENABLED(CONFIG_PPC32))
                return -EOPNOTSUPP;
 
+       /* make sure that any argument can be located and processed by the
+        * trampoline
+        */
+       ret = validate_args(m);
+       if (ret)
+               return ret;
+
        nr_regs = m->nr_args;
        /* Extra registers for struct arguments */
        for (i = 0; i < m->nr_args; i++)
                if (m->arg_size[i] > SZL)
                        nr_regs += round_up(m->arg_size[i], SZL) / SZL - 1;
 
-       if (nr_regs > MAX_BPF_FUNC_ARGS)
-               return -EOPNOTSUPP;
-
        ctx = &codegen_ctx;
        memset(ctx, 0, sizeof(*ctx));
 

-- 
2.49.0