Re: [PATCH bpf v3 1/7] bpf: Make post-verification instruction rewrites killable

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2026-09-14 at 15:16 +0200, Kumar Kartikeya Dwivedi wrote:
> After do_check() returns, the verifier runs several instruction rewrite
> passes. Some of them patch or remove one instruction at a time. Each
> operation moves the remaining instruction and auxiliary-data arrays and
> adjusts all branch offsets, making the overall work quadratic in the
> program length.
> 
> A privileged loader can submit 131072 unconditional jumps by zero followed
> by a valid return. Verification finishes quickly, but bpf_opt_remove_nops()
> then spends a long time removing each jump separately. Since this
> post-verification work neither checks for signals nor reschedules, a pending
> SIGKILL cannot terminate the task until the rewrite finishes.
> 
> Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation
> and rescheduling points. These helpers run from BPF_PROG_LOAD process
> context, and bpf_patch_insn_data() can already sleep while reallocating
> auxiliary data.
> 
> Report interrupted constant blinding as -EINTR and propagate it through
> both JIT paths, including kernels that permit interpreter fallback.
> Other blinding failures retain the existing fallback behavior.
> 
> This does not reduce the quadratic cost of the rewrite passes, but it makes
> the work preemptible and allows a killed loader to be torn down promptly.
> 
> Fixes: 52875a04f4b2 ("bpf: verifier: remove dead code")
> Reported-by: Nicholas Carlini <npc@anthropic.com>
> Suggested-by: Nicholas Carlini <npc@anthropic.com>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

...

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 8b294dfc1ad4..df1eb43d1933 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c

...

> @@ -2625,7 +2628,8 @@ static bool bpf_prog_select_interpreter(struct bpf_prog *fp)
>  	return select_interpreter;
>  }
>  
> -static struct bpf_prog *bpf_prog_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)
> +static struct bpf_prog *bpf_prog_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog,
> +					     int *err)

Nit: in case if there would be a respin because of the CO-RE handling,
     I'd suggest to avoid adding the `err` parameter and using ERR_PTR
     mechanics instead.

>  {
>  #ifdef CONFIG_BPF_JIT
>  	struct bpf_prog *orig_prog;

...