Re: [PATCH bpf-next v9 2/2] bpf: Reject programs with inlined helpers if JIT is not available

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch unconditionally sets `prog->jit_required = 1` and skips instruction patching for helpers that can be JIT-inlined, which unnecessarily breaks the execution of these BPF helpers under the BPF interpreter when JIT is globally disabled.
--

--- Patch [2]: [PATCH bpf-next v9 2/2] bpf: Reject programs with inlined helpers if JIT is not available ---
commit 28807bd656d66a091e77d8589e0c48bef3c4c778
Author: Tiezhu Yang <yangtiezhu@loongson.cn>

bpf: Reject programs with inlined helpers if JIT is not available

This commit modifies bpf_do_misc_fixups() to set prog->jit_required = 1
when bpf_jit_inlines_helper_call() returns true. This is intended to prevent
a kernel panic when JIT compilation fails or is disabled and the interpreter
tries to execute an unpatched helper call with a raw ID.

> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
> index 02246df2f6c36..d3be972714b22 100644
> --- a/kernel/bpf/fixups.c
> +++ b/kernel/bpf/fixups.c
> @@ -1840,8 +1840,10 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env)
>  		}
>  
>  		/* Skip inlining the helper call if the JIT does it. */
> -		if (bpf_jit_inlines_helper_call(insn->imm))
> +		if (bpf_jit_inlines_helper_call(insn->imm)) {
> +			prog->jit_required = 1;
>  			goto next_insn;
> +		}

[Severity: High]
Does this unnecessarily reject valid programs when JIT is globally disabled?

If JIT is disabled (net.core.bpf_jit_enable=0), prog->jit_requested will be
false. By unconditionally skipping the instruction patching and setting
prog->jit_required = 1, valid BPF programs using standard helpers (like
bpf_get_smp_processor_id) will be rejected on architectures supporting this
JIT inlining.

If this code instead checked whether JIT was actually requested:

    if (prog->jit_requested && bpf_jit_inlines_helper_call(insn->imm)) {
        prog->jit_required = 1;
        goto next_insn;
    }

Would this allow the code to fall through and rewrite the offset when JIT is
disabled? This would correctly resolve the helper's C function address,
safely allowing the BPF interpreter to execute these standard helpers without
crashing, while still preventing the runtime panic if dynamic JIT compilation
fails.

>  
>  		if (insn->imm == BPF_FUNC_get_route_realm)
>  			prog->dst_needed = 1;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708101806.18885-1-yangtiezhu@loongson.cn?part=2