* [PATCH bpf-next v5] bpf: Reject programs with inlined helpers if JIT is unavailable
@ 2026-07-02 2:21 Tiezhu Yang
2026-07-02 3:17 ` Leon Hwang
0 siblings, 1 reply; 4+ messages in thread
From: Tiezhu Yang @ 2026-07-02 2:21 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, KaFai Wan
Cc: bpf, loongarch, Leon Hwang
When an architecture implements bpf_jit_inlines_helper_call(), such as
LoongArch, ARM64, PowerPC, and RISC-V, the verifier skips rewriting the
helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
because the helper is expected to be inlined by the JIT compiler. As a
result, insn->imm remains as the raw helper enum ID.
However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
if the JIT compilation later dynamically fails (e.g., due to OOM), the
core BPF subsystem falls back to the BPF interpreter.
When the interpreter executes (__bpf_call_base + insn->imm) with the
unpatched raw helper ID, it jumps into an unaligned invalid address
space, triggering an instruction alignment fault or a memory access
panic.
To avoid modifying the BPF interpreter's complexity for JIT-specific
paths, just introduce a 'jit_required' flag in struct bpf_prog. When
a program contains helper calls that skip rewriting for JIT inlining,
set this flag to 1. During runtime selection, if JIT compilation is
not available, explicitly reject loading with -ENOTSUPP instead of
falling back to the interpreter, safely preventing the kernel panic.
Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
v5:
- Drop the fallback interpreter fixups as per maintainer's feedback.
- Introduce 'jit_required' member in struct bpf_prog to flag programs
that strictly rely on JIT.
- Reject loading with -ENOTSUPP in __bpf_prog_select_runtime() if JIT
fails or is disabled for these programs.
- Upgrade 'jited' bitfield group type from u16 to u32 in struct bpf_prog
to prevent 17-bit overflow warning.
include/linux/bpf.h | 3 ++-
kernel/bpf/core.c | 2 +-
kernel/bpf/fixups.c | 4 +++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ba09795e0bfd..463fae6a5c33 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1865,8 +1865,9 @@ struct bpf_prog_aux {
struct bpf_prog {
u16 pages; /* Number of allocated pages */
- u16 jited:1, /* Is our filter JIT'ed? */
+ u32 jited:1, /* Is our filter JIT'ed? */
jit_requested:1,/* archs need to JIT the prog */
+ jit_required:1, /* program strictly requires JIT compiler */
gpl_compatible:1, /* Is filter GPL compatible? */
cb_access:1, /* Is control block accessed? */
dst_needed:1, /* Do we need dst entry? */
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 649cce41e13f..a55754bcc593 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2639,7 +2639,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
fp = bpf_prog_jit_compile(env, fp);
bpf_prog_jit_attempt_done(fp);
- if (!fp->jited && jit_needed) {
+ if (!fp->jited && (jit_needed || fp->jit_required)) {
*err = -ENOTSUPP;
return fp;
}
diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
index 12a8a4eb757f..94e0457a0aa3 100644
--- a/kernel/bpf/fixups.c
+++ b/kernel/bpf/fixups.c
@@ -1841,8 +1841,10 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env)
}
/* Skip inlining the helper call if the JIT does it. */
- if (bpf_jit_inlines_helper_call(insn->imm))
+ if (bpf_jit_inlines_helper_call(insn->imm)) {
+ prog->jit_required = 1;
goto next_insn;
+ }
if (insn->imm == BPF_FUNC_get_route_realm)
prog->dst_needed = 1;
--
2.42.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH bpf-next v5] bpf: Reject programs with inlined helpers if JIT is unavailable
2026-07-02 2:21 [PATCH bpf-next v5] bpf: Reject programs with inlined helpers if JIT is unavailable Tiezhu Yang
@ 2026-07-02 3:17 ` Leon Hwang
2026-07-02 3:31 ` Tiezhu Yang
0 siblings, 1 reply; 4+ messages in thread
From: Leon Hwang @ 2026-07-02 3:17 UTC (permalink / raw)
To: Tiezhu Yang, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, KaFai Wan
Cc: bpf, loongarch
On 2/7/26 10:21, Tiezhu Yang wrote:
[...]
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index ba09795e0bfd..463fae6a5c33 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1865,8 +1865,9 @@ struct bpf_prog_aux {
>
> struct bpf_prog {
> u16 pages; /* Number of allocated pages */
> - u16 jited:1, /* Is our filter JIT'ed? */
> + u32 jited:1, /* Is our filter JIT'ed? */
> jit_requested:1,/* archs need to JIT the prog */
> + jit_required:1, /* program strictly requires JIT compiler */
Looks good to put jit_required together with jit_requested.
However, 'u16 -> u32' changes the layout of struct bpf_prog.
Before the change, pahole -C bpf_prog ./vmlinux
struct bpf_prog {
u16 pages; /* 0 2 */
u16 jited:1; /* 2: 0 2 */
u16 jit_requested:1; /* 2: 1 2 */
u16 gpl_compatible:1; /* 2: 2 2 */
u16 cb_access:1; /* 2: 3 2 */
u16 dst_needed:1; /* 2: 4 2 */
u16 blinding_requested:1; /* 2: 5 2 */
u16 blinded:1; /* 2: 6 2 */
u16 is_func:1; /* 2: 7 2 */
u16 kprobe_override:1; /* 2: 8 2 */
u16 has_callchain_buf:1; /* 2: 9 2 */
u16 enforce_expected_attach_type:1; /* 2:10
2 */
u16 call_get_stack:1; /* 2:11 2 */
u16 call_get_func_ip:1; /* 2:12 2 */
u16 call_session_cookie:1; /* 2:13 2 */
u16 tstamp_type_access:1; /* 2:14 2 */
u16 sleepable:1; /* 2:15 2 */
enum bpf_prog_type type; /* 4 4 */
enum bpf_attach_type expected_attach_type; /* 8 4 */
u32 len; /* 12 4 */
u32 jited_len; /* 16 4 */
union {
u8 digest[32]; /* 20 32 */
u8 tag[8]; /* 20 8 */
}; /* 20 32 */
/* XXX 4 bytes hole, try to pack */
struct bpf_prog_stats * stats; /* 56 8 */
/* --- cacheline 1 boundary (64 bytes) --- */
u8 * active; /* 64 8 */
unsigned int (*bpf_func)(const void *, const struct
bpf_insn *); /* 72 8 */
struct bpf_prog_aux * aux; /* 80 8 */
struct sock_fprog_kern * orig_prog; /* 88 8 */
union {
struct {
struct {
} __empty_insns; /* 96 0 */
struct sock_filter insns[0]; /* 96 0 */
}; /* 96 0 */
struct {
struct {
} __empty_insnsi; /* 96 0 */
struct bpf_insn insnsi[0]; /* 96 0 */
}; /* 96 0 */
}; /* 96 0 */
/* size: 96, cachelines: 2, members: 28 */
/* sum members: 90, holes: 1, sum holes: 4 */
/* sum bitfield members: 16 bits (2 bytes) */
/* last cacheline: 32 bytes */
};
After the change, pahole -C bpf_prog ./vmlinux
struct bpf_prog {
u16 pages; /* 0 2 */
/* Bitfield combined with previous fields */
u32 jited:1; /* 0:16 4 */
u32 jit_requested:1; /* 0:17 4 */
u32 jit_required:1; /* 0:18 4 */
u32 gpl_compatible:1; /* 0:19 4 */
u32 cb_access:1; /* 0:20 4 */
u32 dst_needed:1; /* 0:21 4 */
u32 blinding_requested:1; /* 0:22 4 */
u32 blinded:1; /* 0:23 4 */
u32 is_func:1; /* 0:24 4 */
u32 kprobe_override:1; /* 0:25 4 */
u32 has_callchain_buf:1; /* 0:26 4 */
u32 enforce_expected_attach_type:1; /* 0:27
4 */
u32 call_get_stack:1; /* 0:28 4 */
u32 call_get_func_ip:1; /* 0:29 4 */
u32 call_session_cookie:1; /* 0:30 4 */
u32 tstamp_type_access:1; /* 0:31 4 */
u32 sleepable:1; /* 4: 0 4 */
/* XXX 31 bits hole, try to pack */
enum bpf_prog_type type; /* 8 4 */
enum bpf_attach_type expected_attach_type; /* 12 4 */
u32 len; /* 16 4 */
u32 jited_len; /* 20 4 */
union {
u8 digest[32]; /* 24 32 */
u8 tag[8]; /* 24 8 */
}; /* 24 32 */
struct bpf_prog_stats * stats; /* 56 8 */
/* --- cacheline 1 boundary (64 bytes) --- */
u8 * active; /* 64 8 */
unsigned int (*bpf_func)(const void *, const struct
bpf_insn *); /* 72 8 */
struct bpf_prog_aux * aux; /* 80 8 */
struct sock_fprog_kern * orig_prog; /* 88 8 */
union {
struct {
struct {
} __empty_insns; /* 96 0 */
struct sock_filter insns[0]; /* 96 0 */
}; /* 96 0 */
struct {
struct {
} __empty_insnsi; /* 96 0 */
struct bpf_insn insnsi[0]; /* 96 0 */
}; /* 96 0 */
}; /* 96 0 */
/* size: 96, cachelines: 2, members: 29 */
/* sum members: 90 */
/* sum bitfield members: 17 bits, bit holes: 1, sum bit holes: 31 bits */
/* last cacheline: 32 bytes */
};
Luckily, the total size keeps 96 bytes. The layout change is the hole:
from 4 bytes to 31 bits.
Thanks,
Leon
> gpl_compatible:1, /* Is filter GPL compatible? */
> cb_access:1, /* Is control block accessed? */
> dst_needed:1, /* Do we need dst entry? */
> [...]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH bpf-next v5] bpf: Reject programs with inlined helpers if JIT is unavailable
2026-07-02 3:17 ` Leon Hwang
@ 2026-07-02 3:31 ` Tiezhu Yang
2026-07-02 5:39 ` Alexei Starovoitov
0 siblings, 1 reply; 4+ messages in thread
From: Tiezhu Yang @ 2026-07-02 3:31 UTC (permalink / raw)
To: Leon Hwang, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, KaFai Wan
Cc: bpf, loongarch
On 2026/7/2 上午11:17, Leon Hwang wrote:
> On 2/7/26 10:21, Tiezhu Yang wrote:
> [...]
>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> index ba09795e0bfd..463fae6a5c33 100644
>> --- a/include/linux/bpf.h
>> +++ b/include/linux/bpf.h
>> @@ -1865,8 +1865,9 @@ struct bpf_prog_aux {
>>
>> struct bpf_prog {
>> u16 pages; /* Number of allocated pages */
>> - u16 jited:1, /* Is our filter JIT'ed? */
>> + u32 jited:1, /* Is our filter JIT'ed? */
>> jit_requested:1,/* archs need to JIT the prog */
>> + jit_required:1, /* program strictly requires JIT compiler */
>
> Looks good to put jit_required together with jit_requested.
>
> However, 'u16 -> u32' changes the layout of struct bpf_prog.
>
> Before the change, pahole -C bpf_prog ./vmlinux
>
> struct bpf_prog {
> u16 pages; /* 0 2 */
> u16 jited:1; /* 2: 0 2 */
> u16 jit_requested:1; /* 2: 1 2 */
> u16 gpl_compatible:1; /* 2: 2 2 */
> u16 cb_access:1; /* 2: 3 2 */
> u16 dst_needed:1; /* 2: 4 2 */
> u16 blinding_requested:1; /* 2: 5 2 */
> u16 blinded:1; /* 2: 6 2 */
> u16 is_func:1; /* 2: 7 2 */
> u16 kprobe_override:1; /* 2: 8 2 */
> u16 has_callchain_buf:1; /* 2: 9 2 */
> u16 enforce_expected_attach_type:1; /* 2:10
> 2 */
> u16 call_get_stack:1; /* 2:11 2 */
> u16 call_get_func_ip:1; /* 2:12 2 */
> u16 call_session_cookie:1; /* 2:13 2 */
> u16 tstamp_type_access:1; /* 2:14 2 */
> u16 sleepable:1; /* 2:15 2 */
> enum bpf_prog_type type; /* 4 4 */
> enum bpf_attach_type expected_attach_type; /* 8 4 */
> u32 len; /* 12 4 */
> u32 jited_len; /* 16 4 */
> union {
> u8 digest[32]; /* 20 32 */
> u8 tag[8]; /* 20 8 */
> }; /* 20 32 */
>
> /* XXX 4 bytes hole, try to pack */
>
> struct bpf_prog_stats * stats; /* 56 8 */
Hi,
Thank you for the detailed pahole analysis! You are absolutely right.
Changing 'u16 -> u32' for the bitfield group row implicitly changed
the layout of subsequent fields like 'type', disrupting their natural
alignment and padding.
To address this and preserve the original bitfield packed layout perfectly,
I have rolled back the 'u16 -> u32' change. Instead, I moved 'jit_required'
out of the bitfield group and declared it as a standalone 'u8' field right
before 'stats'. This elegantly packs it into the existing 4-byte structural
hole (at offset 52).
The total size of struct bpf_prog stays exactly at 96 bytes, with zero
alignment regression.
Here is the incremental diff based on the previous v5 patch:
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 463fae6a5c33..f5c283af3cf7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1865,9 +1865,8 @@ struct bpf_prog_aux {
struct bpf_prog {
u16 pages; /* Number of allocated
pages */
- u32 jited:1, /* Is our filter JIT'ed? */
+ u16 jited:1, /* Is our filter JIT'ed? */
jit_requested:1,/* archs need to JIT
the prog */
- jit_required:1, /* program strictly
requires JIT compiler */
gpl_compatible:1, /* Is filter GPL
compatible? */
cb_access:1, /* Is control block
accessed? */
dst_needed:1, /* Do we need dst entry? */
@@ -1890,6 +1889,7 @@ struct bpf_prog {
u8 digest[SHA256_DIGEST_SIZE];
u8 tag[BPF_TAG_SIZE];
};
+ u8 jit_required; /* program strictly
requires JIT compiler */
struct bpf_prog_stats __percpu *stats;
u8 __percpu *active; /* u8[BPF_NR_CONTEXTS]
for recursion protection */
unsigned int (*bpf_func)(const void *ctx,
I will collect this optimization and send out the formal V6 patchset
shortly.
Thanks,
Tiezhu
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH bpf-next v5] bpf: Reject programs with inlined helpers if JIT is unavailable
2026-07-02 3:31 ` Tiezhu Yang
@ 2026-07-02 5:39 ` Alexei Starovoitov
0 siblings, 0 replies; 4+ messages in thread
From: Alexei Starovoitov @ 2026-07-02 5:39 UTC (permalink / raw)
To: Tiezhu Yang
Cc: Leon Hwang, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, KaFai Wan,
bpf, loongarch
On Wed, Jul 1, 2026 at 8:31 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
>
> Hi,
>
> Thank you for the detailed pahole analysis! You are absolutely right.
> Changing 'u16 -> u32' for the bitfield group row implicitly changed
> the layout of subsequent fields like 'type', disrupting their natural
> alignment and padding.
>
> To address this and preserve the original bitfield packed layout perfectly,
> I have rolled back the 'u16 -> u32' change. Instead, I moved 'jit_required'
> out of the bitfield group and declared it as a standalone 'u8' field right
> before 'stats'. This elegantly packs it into the existing 4-byte structural
> hole (at offset 52).
Your replies smell AI way too much.
If I sense it again you will be banned and all your patches will be rejected.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-02 5:39 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-02 2:21 [PATCH bpf-next v5] bpf: Reject programs with inlined helpers if JIT is unavailable Tiezhu Yang
2026-07-02 3:17 ` Leon Hwang
2026-07-02 3:31 ` Tiezhu Yang
2026-07-02 5:39 ` Alexei Starovoitov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.