Overflowing the kernel stack with BPF
summary
Demonstrates concrete exploits where eBPF code overflows the kernel stack by abusing verifier assumptions: the verifier assumes 8KB assumption of available stack, but attaching on bloated paths like XFS yields >6KB base stacks and kprobes can push total usage past 10KB; combining BPF-to-BPF frames with tail calls (the runtime limits to 33 tail calls are bypassed) grows a 512‑byte verifier view into ~8KB at runtime; nesting via kprobe+fentry nesting or helper-attached programs reproduces stack exhaustion; mitigation proposals include per-BPF stack switching or strict nesting/attachment limits.
AI-written summary · about
chapters (7)
- 0:00Introduction to BPF
- 1:12BPF stack interaction
- 4:45Kernel stack assumptions
- 5:51Base kernel stack overflow
- 7:58Uncontrolled nesting issue
- 12:33Potential solutions
- 15:25Q&A session
related talks
42mKernel Analysis Using eBPF
19meBPF User Stack Trace Issue and Solutions
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel
34mWhat's new in the BPF world?
36mObservability and performance analysis with BPF
32meBPF: BPF kernel infrastructure
25mKernel tracing with BPF
42mResolving Performance and Security Issues with eBPF