Re: [PATCH bpf-next v3 3/9] bpf: fetch the vmlinux BTF where kernel types enter a program

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: state-dependent verification failure for BTF-independent programs
--

commit f6fc508c855b2ee6adf6ef6d3d2ccfe35410bcf1
Author: Jay Wang <wanjay@amazon.com>

bpf: fetch the vmlinux BTF where kernel types enter a program

This commit delays fetching the vmlinux BTF until kernel types actually
enter the verifier state. This prevents unnecessary loading and parsing
of BTF for BTF-independent programs like socket filters, saving memory
and parsing overhead.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -22532,10 +22580,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
>  
>  	mark_verifier_state_clean(env);
>  
> -	if (IS_ERR(btf_vmlinux)) {
> +	if (IS_ERR(bpf_peek_btf_vmlinux())) {

[Severity: High]
Could this introduce a state-dependent verification failure for
BTF-independent programs?

When a BTF-independent program (like a systemd socket filter) is loaded
initially, the bpf_peek_btf_vmlinux() helper returns a null pointer and this
check is bypassed.

If a BTF-dependent program is later loaded under memory pressure, the
btf_parse_vmlinux() routine could fail with a memory allocation error. When
the kernel is configured with BTF enabled, bpf_get_btf_vmlinux() permanently
stores this error pointer in the global btf_vmlinux variable.

Subsequent loads of completely unrelated, BTF-independent programs will now
see the error pointer returned by bpf_peek_btf_vmlinux() evaluate to true
and fail with an in-kernel BTF is malformed error in bpf_check().

Will this unintentionally cause transient memory failures during BTF parsing
to permanently break unrelated critical system services?

>  		/* Either gcc or pahole or kernel are broken. */
>  		verbose(env, "in-kernel BTF is malformed\n");
> -		ret = PTR_ERR(btf_vmlinux);
> +		ret = PTR_ERR(bpf_peek_btf_vmlinux());
>  		goto skip_full_check;
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925224229.1850-1-wanjay@amazon.com?part=3