bpf: Keep stack arguments in arch_bpf_timed_may_goto()

The JITs pass the first stack arguments of a call in registers:

  x86-64    r9       argument 6
  arm64     x5-x7    arguments 6-8
  riscv64   a5-a7    arguments 6-8

'*(u64 *)(r11 - 8) = rX' writes such a register in the caller.
'rX = *(u64 *)(r11 + 8)' reads it in the callee. A call changes these
registers. Thus the verifier accepts no call between the write and the call
of the callee, and no call in the callee before the read.

may_goto is not a call for the verifier. But one time in 65535 iterations
it calls arch_bpf_timed_may_goto(), and this function calls C code. It
saves R0-R5 only.

       *(u64 *)(r11 - 8) = 0      ; the verifier: argument 6 is 0
       call sub
  sub:
    1: may_goto 2f                ; C code changes r9
       goto 1b
    2: r2 = *(u64 *)(r11 + 8)     ; r2 is a kernel address
       r1 = map_value
       r1 += r2
       *(u64 *)(r1 + 0) = 0

On x86-64 the C code changes r9 when the time of may_goto is up. With the
hpet clocksource a look at the clock changes r9 too. The prog above crashes
the kernel. LLVM does not emit such code: it reads stack arguments at the
entry of a function, and it writes them immediately before the call.

Save and restore these registers too. The cost is 2 insns on x86-64, 4 on
arm64 and 6 on riscv64, one time in 65535 iterations.

Fixes: 324c3ca6eed6 ("bpf,x86: Implement JIT support for stack arguments")
Fixes: 235b2fe772f5 ("bpf, arm64: Add JIT support for stack arguments")
Fixes: ba754185f902 ("riscv, bpf: Add BPF stack arguments support for RV64 JIT")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261027190314.1440199-19-alexei.starovoitov@gmail.com

0 files changed, 0 insertions, 0 deletions