From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from 66-220-155-178.mail-mxout.facebook.com (66-220-155-178.mail-mxout.facebook.com [66.220.155.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 869C43AE1BB for ; Fri, 9 Oct 2026 04:15:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.220.155.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791519355; cv=none; b=dxB2y4y/L44A/UspHSZpUAeUrNi4oMU52nqJqyCw/4zAuY/XJX3EAXYvAipS+XE/+B0Axablq0tXvTH6U/f4DP5sNVMl3y3aWuCPZNKnIkILkjudi6TFq9lvNWj6fVhaDDofR54/pngaRB7uRD4B0yE0Frt7sg9CVB5exJvzSiQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791519355; c=relaxed/simple; bh=X2L87VNE35CcxRzMw9Isk1hvOdrFWou8af531MsSfUc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uYUGv5bjo1JIrMhru6N8uxx/dw3FCKYUBndpVz8P+joa+KkC6dm0tEGqg75vRbCZSHOOcbT2tlaBsE9UOEvxDoleqeFa+uaP8vfViCGcpBCpCNGIUltM+Z7uhcXRFOt/1OjiyojT5Cqw4Sr+okeouTgb9tb5OlsZ6iAmULuMwQA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev; spf=fail smtp.mailfrom=linux.dev; arc=none smtp.client-ip=66.220.155.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=linux.dev Received: by devvm16039.vll0.facebook.com (Postfix, from userid 128203) id 2AF2D3008C4EEB; Thu, 8 Oct 2026 21:15:29 -0700 (PDT) From: Yonghong Song To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Eduard Zingerman , kernel-team@fb.com Subject: [PATCH bpf-next v10 08/24] bpf: Refuse a callback that can unwind Date: Thu, 8 Oct 2026 21:15:28 -0700 Message-ID: <20261009041528.27166-1-yonghong.song@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261009041447.17092-1-yonghong.song@linux.dev> References: <20261009041447.17092-1-yonghong.song@linux.dev> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable A callback is not called by the program but by kernel code, a helper or a kfunc such as bpf_loop(), which the callback returns to and which then returns to the program: main -> A -> bpf_loop() -> cb -> C C calls bpf_unwind() Once a later patch makes bpf_unwind() dispatch pads, it rewrites the return address of each of the program's frames and stops at the first frame that is not one, here bpf_loop(): kernel code with its own frame and state, which the walk cannot send cb past. So cb returns into bpf_loop(), which goes on looping and then returns to A after its call, while the verifier follows the unwind from cb straight into A. Refuse a callback subprog marked might_unwind. The check does not depend on a cleanup table: without one, bpf_unwind() still sends every frame it walks through its epilogue and still stops at bpf_loop(), so the mismatch is the same. Signed-off-by: Yonghong Song --- kernel/bpf/exception.c | 9 +++++++++ kernel/bpf/exception.h | 1 + kernel/bpf/verifier.c | 4 ++++ 3 files changed, 14 insertions(+) diff --git a/kernel/bpf/exception.c b/kernel/bpf/exception.c index 21bc1294227c..a0f088e225ac 100644 --- a/kernel/bpf/exception.c +++ b/kernel/bpf/exception.c @@ -141,6 +141,15 @@ int bpf_exc_check_info(struct bpf_verifier_env *env,= const union bpf_attr *attr, BTF_ID_LIST_SINGLE(bpf_unwind_id, func, bpf_unwind) BTF_ID_LIST_SINGLE(bpf_unwind_resume_id, func, bpf_unwind_resume) =20 +int bpf_exc_check_callback(struct bpf_verifier_env *env, int subprog) +{ + if (!env->subprog_info[subprog].might_unwind) + return 0; + + verbose(env, "subprog %d may unwind and is used as a callback\n", subpr= og); + return -EINVAL; +} + static int reject_throw(struct bpf_verifier_env *env) { u32 i; diff --git a/kernel/bpf/exception.h b/kernel/bpf/exception.h index 9b75e556c82e..983b9af16a19 100644 --- a/kernel/bpf/exception.h +++ b/kernel/bpf/exception.h @@ -17,5 +17,6 @@ int bpf_exc_check_prog(struct bpf_verifier_env *env); int bpf_exc_pad_of_call(struct bpf_verifier_env *env, u32 idx); bool bpf_is_unwind_kfunc(const struct bpf_insn *insn); bool bpf_is_unwind_resume_kfunc(const struct bpf_insn *insn); +int bpf_exc_check_callback(struct bpf_verifier_env *env, int subprog); =20 #endif /* __BPF_EXCEPTION_H */ diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1553c7d5bbdb..4ab838ba21eb 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -10997,6 +10997,10 @@ static int push_callback_call(struct bpf_verifie= r_env *env, struct bpf_insn *ins * callbacks */ env->subprog_info[subprog].is_cb =3D true; + err =3D bpf_exc_check_callback(env, subprog); + if (err) + return err; + if (bpf_pseudo_kfunc_call(insn) && !is_callback_calling_kfunc(insn->imm)) { verifier_bug(env, "kfunc %s#%d not marked as callback-calling", --=20 2.53.0-Meta