Re: [PATCH bpf-next v2 06/17] bpf: Add callx calls to the call graph

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: sort_subprogs_topo() misses callback edges, failing to detect bounded recursion
--

commit 1cc83e74951c3df35b0b794cf4a90e325a1cff05
Author: Alexei Starovoitov <ast@kernel.org>

bpf: Add callx calls to the call graph

This commit updates the verifier to record caller to callee edges for callx
and sync callbacks during the main verification pass. It then uses these
recorded edges in sort_subprogs_topo() to detect bounded recursion via
indirect calls, and in check_max_stack_depth_subprog() to walk the callees.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index eb014bf6a2e87..d00d0ecab17cf 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -3195,12 +3233,22 @@ static int sort_subprogs_topo(struct bpf_verifier_env *env)
>  				int idx = insn_postorder[j];
>  				int callee;
>  
> -				if (!bpf_pseudo_call(&insn[idx]) && !bpf_pseudo_func(&insn[idx]))
> +				if (bpf_is_callx(&insn[idx])) {

[Severity: Medium]
Does this code miss callback edges when checking for cycles?

The commit message mentions that sync callback edges are recorded, and
check_max_stack_depth_subprog() checks both bpf_is_callx() and
bpf_calls_callback().

However, this condition only checks for bpf_is_callx(). If a BPF program
uses a sync callback (e.g., bpf_loop) to call a subprogram, which then
recursively calls the original subprogram, and neither subprogram contains a
callx instruction, would sort_subprogs_topo() silently ignore the callback
edges and fail to detect the cycle here?

Should this condition be expanded to check for bpf_calls_callback(env, idx)
so that callback edges are correctly registered during topological sorting?

> +					/* find a callee that is not explored yet */
> +					callee = -1;
> +					do {
> +						callee = next_callx_callee(env, cur, callee + 1);
> +					} while (callee >= 0 && color[callee] == 2);
> +					if (callee < 0)
> +						continue;
> +				} else if (bpf_pseudo_call(&insn[idx]) || bpf_pseudo_func(&insn[idx])) {
> +					callee = bpf_find_subprog(env, idx + insn[idx].imm + 1);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924031042.1690890-1-alexei.starovoitov@gmail.com?part=6