[PATCH bpf-next v3 4/6] bpf: Disallow !call_get_func_ip progs tail-calling call_get_func_ip progs
From: Leon Hwang <hidden>
Date: 2026-03-03 15:08:39
Also in:
linux-kselftest, lkml, netdev
Subsystem:
bpf [core], bpf [general] (safe dynamic programs and tools), the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, Linus Torvalds
Trampoline-based tracing programs that call bpf_get_func_ip() rely on
the func IP stored on the stack. Mixing !call_get_func_ip progs with
call_get_func_ip progs via tail calls could break this assumption.
To address this, reject the combination of !call_get_func_ip progs with
call_get_func_ip progs in bpf_map_owner_matches(), which prevents the
tail callee from getting a bogus func IP.
Also reject call_get_func_ip mismatches during initialization to
prevent bypassing the above restriction.
Without this check, the above restriction can be bypassed as follows.
struct {
__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
__uint(max_entries, 1);
__uint(key_size, sizeof(__u32));
__uint(value_size, sizeof(__u32));
} jmp_table SEC(".maps");
SEC("?fentry")
int BPF_PROG(prog_a)
{
bpf_printk("FUNC IP: 0x%llx\n", bpf_get_func_ip());
bpf_tail_call_static(ctx, &jmp_table, 0);
return 0;
}
SEC("?fentry")
int BPF_PROG(prog_b)
{
bpf_tail_call_static(ctx, &jmp_table, 0);
return 0;
}
The jmp_table is shared between prog_a and prog_b.
* Load prog_a first.
At this point, owner->call_get_func_ip=true.
* Load prog_b next.
At this point, prog_b passes the compatibility check.
* Add prog_a to jmp_table.
* Attach prog_b to a kernel function.
When the kernel function runs, prog_a will get a bogus func IP because
no func IP is prepared on the trampoline stack.
Fixes: 1e37392cccde ("bpf: Enable BPF_TRAMP_F_IP_ARG for trampolines with call_get_func_ip")
Signed-off-by: Leon Hwang <redacted>
---
include/linux/bpf.h | 1 +
kernel/bpf/core.c | 10 ++++++++++
2 files changed, 11 insertions(+)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index dbafed52b2ba..fb978650b169 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h@@ -289,6 +289,7 @@ struct bpf_map_owner { u32 xdp_has_frags:1; u32 sleepable:1; u32 kprobe_write_ctx:1; + u32 call_get_func_ip:1; u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; const struct btf_type *attach_func_proto; enum bpf_attach_type expected_attach_type;
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 121a697d4da5..d20a90bd1d2b 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c@@ -2391,6 +2391,7 @@ static void bpf_map_owner_init(struct bpf_map_owner *owner, const struct bpf_pro owner->xdp_has_frags = aux->xdp_has_frags; owner->sleepable = fp->sleepable; owner->kprobe_write_ctx = aux->kprobe_write_ctx; + owner->call_get_func_ip = fp->call_get_func_ip; owner->expected_attach_type = fp->expected_attach_type; owner->attach_func_proto = aux->attach_func_proto; for_each_cgroup_storage_type(i)
@@ -2407,6 +2408,7 @@ static bool bpf_map_owner_matches(const struct bpf_map *map, const struct bpf_pr enum bpf_prog_type prog_type, enum bpf_map_owner_match_type match) { + bool has_trampoline = bpf_prog_has_trampoline(fp); struct bpf_map_owner *owner = map->owner; struct bpf_prog_aux *aux = fp->aux; enum bpf_cgroup_storage_type i;
@@ -2422,11 +2424,19 @@ static bool bpf_map_owner_matches(const struct bpf_map *map, const struct bpf_pr case BPF_MAP_OWNER_MATCH_FOR_INIT: if (owner->kprobe_write_ctx != aux->kprobe_write_ctx) return false; + if (has_trampoline) { + if (owner->call_get_func_ip != fp->call_get_func_ip) + return false; + } break; case BPF_MAP_OWNER_MATCH_FOR_UPDATE: if (!owner->kprobe_write_ctx && aux->kprobe_write_ctx) return false; + if (has_trampoline) { + if (!owner->call_get_func_ip && fp->call_get_func_ip) + return false; + } break; }
--
2.52.0