Patch "bpf: Fix max stack depth check for async callbacks" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Fix max stack depth check for async callbacks

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-max-stack-depth-check-for-async-callbacks.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 55cdae98eb5599d22f834a51825f1a914abbf29a
Author: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
Date:   Wed Jul 5 20:17:29 2023 +0530

    bpf: Fix max stack depth check for async callbacks
    
    [ Upstream commit 5415ccd50a8620c8cbaa32d6f18c946c453566f5 ]
    
    The check_max_stack_depth pass happens after the verifier's symbolic
    execution, and attempts to walk the call graph of the BPF program,
    ensuring that the stack usage stays within bounds for all possible call
    chains. There are two cases to consider: bpf_pseudo_func and
    bpf_pseudo_call. In the former case, the callback pointer is loaded into
    a register, and is assumed that it is passed to some helper later which
    calls it (however there is no way to be sure), but the check remains
    conservative and accounts the stack usage anyway. For this particular
    case, asynchronous callbacks are skipped as they execute asynchronously
    when their corresponding event fires.
    
    The case of bpf_pseudo_call is simpler and we know that the call is
    definitely made, hence the stack depth of the subprog is accounted for.
    
    However, the current check still skips an asynchronous callback even if
    a bpf_pseudo_call was made for it. This is erroneous, as it will miss
    accounting for the stack usage of the asynchronous callback, which can
    be used to breach the maximum stack depth limit.
    
    Fix this by only skipping asynchronous callbacks when the instruction is
    not a pseudo call to the subprog.
    
    Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.")
    Signed-off-by: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230705144730.235802-2-memxor@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7a70595c3c15a..bd31aa6407a78 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3765,8 +3765,9 @@ static int check_max_stack_depth(struct bpf_verifier_env *env)
 				verbose(env, "verifier bug. subprog has tail_call and async cb\n");
 				return -EFAULT;
 			}
-			 /* async callbacks don't increase bpf prog stack size */
-			continue;
+			/* async callbacks don't increase bpf prog stack size unless called directly */
+			if (!bpf_pseudo_call(insn + i))
+				continue;
 		}
 		i = next_insn;