Patch "bpf: Assign bpf_tramp_run_ctx::saved_run_ctx before recursion check." has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Assign bpf_tramp_run_ctx::saved_run_ctx before recursion check.

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-assign-bpf_tramp_run_ctx-saved_run_ctx-before-re.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5970c06d55993e427c7bb7196dd6878befcc7dd5
Author: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
Date:   Wed Aug 30 10:04:05 2023 +0200

    bpf: Assign bpf_tramp_run_ctx::saved_run_ctx before recursion check.
    
    [ Upstream commit 6764e767f4af1e35f87f3497e1182d945de37f93 ]
    
    __bpf_prog_enter_recur() assigns bpf_tramp_run_ctx::saved_run_ctx before
    performing the recursion check which means in case of a recursion
    __bpf_prog_exit_recur() uses the previously set bpf_tramp_run_ctx::saved_run_ctx
    value.
    
    __bpf_prog_enter_sleepable_recur() assigns bpf_tramp_run_ctx::saved_run_ctx
    after the recursion check which means in case of a recursion
    __bpf_prog_exit_sleepable_recur() uses an uninitialized value. This does not
    look right. If I read the entry trampoline code right, then bpf_tramp_run_ctx
    isn't initialized upfront.
    
    Align __bpf_prog_enter_sleepable_recur() with __bpf_prog_enter_recur() and
    set bpf_tramp_run_ctx::saved_run_ctx before the recursion check is made.
    Remove the assignment of saved_run_ctx in kern_sys_bpf() since it happens
    a few cycles later.
    
    Fixes: e384c7b7b46d0 ("bpf, x86: Create bpf_tramp_run_ctx on the caller thread's stack")
    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20230830080405.251926-3-bigeasy@xxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 76484137233a3..0c8b7733573ee 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5135,7 +5135,6 @@ int kern_sys_bpf(int cmd, union bpf_attr *attr, unsigned int size)
 		}
 
 		run_ctx.bpf_cookie = 0;
-		run_ctx.saved_run_ctx = NULL;
 		if (!__bpf_prog_enter_sleepable_recur(prog, &run_ctx)) {
 			/* recursion detected */
 			__bpf_prog_exit_sleepable_recur(prog, 0, &run_ctx);
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 88841e352dcdf..c4381dfcd6b09 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -955,13 +955,12 @@ u64 notrace __bpf_prog_enter_sleepable_recur(struct bpf_prog *prog,
 	migrate_disable();
 	might_fault();
 
+	run_ctx->saved_run_ctx = bpf_set_run_ctx(&run_ctx->run_ctx);
+
 	if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) {
 		bpf_prog_inc_misses_counter(prog);
 		return 0;
 	}
-
-	run_ctx->saved_run_ctx = bpf_set_run_ctx(&run_ctx->run_ctx);
-
 	return bpf_prog_start_time();
 }