Re: [PATCH bpf-next v2 12/17] libbpf: Resolve pointers to functions in read-only data

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: exception callbacks bypass callx and func ptr evaluation
--

commit 977905067f5778d4a89e59b4be93e1e229b29d4a
Author: Alexei Starovoitov <ast@kernel.org>

libbpf: Resolve pointers to functions in read-only data

This patch enables libbpf to resolve pointers to static functions located in
read-only data, such as struct ops or vtables. It creates per-program map copies
containing the proper offsets, which the kernel later replaces with addresses.
Programs utilizing callx automatically have statically referenced subprograms
appended during relocation.

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index cd1ea1bb53cbf..fc9b7540aca63 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
[ ... ]
> @@ -7046,7 +7301,7 @@ bpf_object__relocate_calls(struct bpf_object *obj, struct bpf_program *prog)
>  	if (err)
>  		return err;
>  
> -	return 0;
> +	return bpf_object__append_func_ptrs(obj, prog);
>  }
>  

[Severity: Medium]
Will this miss callx instructions and function pointers used inside exception
callbacks?

Looking at bpf_object__relocate() in tools/lib/bpf/libbpf.c,
bpf_object__relocate_calls() is executed before exception callbacks are
appended:

tools/lib/bpf/libbpf.c:bpf_object__relocate() {
    ...
    err = bpf_object__relocate_calls(obj, prog);
    if (err) {
        ...
    }

    err = bpf_prog_assign_exc_cb(obj, prog);
    if (err)
        return err;

    if (prog->exception_cb_idx >= 0) {
        ...
        if (subprog->sub_insn_off == 0) {
            err = bpf_object__append_subprog_code(obj, prog, subprog);
            ...
        }
    }
    ...
}

If the exception callback contains a callx instruction or references a function
pointer map, it seems they would bypass the bpf_object__append_func_ptrs()
evaluation. This could cause their read-only maps to be mis-relocated since
the has_callx state and subprogram appending are finalized prior to processing
the exception callback.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924031042.1690890-1-alexei.starovoitov@gmail.com?part=12