Re: [PATCH bpf-next v4 15/25] bpf: Reject stack arguments if tail call reachable

[Yonghong Song <yonghong.song@linux.dev>]

On 5/15/26 5:23 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [High] Order-dependent verification allows invalid programs combining tail calls and stack arguments to bypass checks.
> - [High] Exception and async callbacks bypass the new stack argument and tail call restriction.
> --
>
> commit 807349b213e40b7418c45dc1ae2cee5695bf101d
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf: Reject stack arguments if tail call reachable
>
> This patch updates the BPF verifier to reject programs that combine tail calls
> with stack arguments, as tail calls are deprecated. It hooks into the call
> depth traversal to fail verification if stack arguments are present in a
> call chain that can reach a tail call.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index a363811aec7a0..47df3f40a71cf 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -5267,14 +5267,23 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
>>   	 * this info will be utilized by JIT so that we will be preserving the
>>   	 * tail call counter throughout bpf2bpf calls combined with tailcalls
>>   	 */
>> -	if (tail_call_reachable)
>> +	if (tail_call_reachable) {
>>   		for (tmp = idx; tmp >= 0; tmp = dinfo[tmp].caller) {
>>   			if (subprog[tmp].is_exception_cb) {
>>   				verbose(env, "cannot tail call within exception cb\n");
>>   				return -EINVAL;
>>   			}
>> +			if (subprog[tmp].stack_arg_cnt) {
> Can this check be bypassed depending on the order of subprogram calls?

No.

>
> If a main program calls subprogram A (which uses stack args) and then
> subprogram B (which has a tail call), it seems subprogram A might be
> evaluated first when tail_call_reachable is false, bypassing this check.
>
> When subprogram B is evaluated, it sets tail_call_reachable to true,
> which propagates to the main program.
>
> When the main program finishes, only the main program's stack_arg_cnt is
> checked, allowing the program to pass verification.

But in this case, main program stack_arg_cnt is not 0, so -EINVAL will return.

> If the calls were reversed, subprogram A would inherit the true state and
> be correctly rejected.
>
> Does this sequence allow invalid programs to bypass the safety check?
>
>> +				verbose(env, "tail_calls are not allowed in programs with stack args\n");
>> +				return -EINVAL;
>> +			}
>>   			subprog[tmp].tail_call_reachable = true;
>>   		}
>> +	} else if (!idx && subprog[0].has_tail_call && subprog[0].stack_arg_cnt) {
> Does this fallback check miss exception and async callbacks?

This check does not deal with exception and async callbacks.

>
> By explicitly checking !idx and subprog[0], it appears to assume the main
> program is the only call graph root.
>
> Since exception and async callbacks are verified independently as their own
> root programs (where idx > 0), would a callback that contains a tail call,
> uses stack arguments, and makes no BPF-to-BPF calls bypass both the primary
> tail_call_reachable check and this fallback check?

As far as I know, callback and exception prog are not allowing tail call.
For example:
                 if (subprog[sidx].is_async_cb) {
                         if (subprog[sidx].has_tail_call) {
                                 verifier_bug(env, "subprog has tail_call and async cb");
                                 return -EFAULT;
                         }
			...
		}

...
         if (tail_call_reachable) {
                 for (tmp = idx; tmp >= 0; tmp = dinfo[tmp].caller) {
                         if (subprog[tmp].is_exception_cb) {
                                 verbose(env, "cannot tail call within exception cb\n");
                                 return -EINVAL;
                         }
			...
		}
	}

>
>> +		verbose(env, "tail_calls are not allowed in programs with stack args\n");
>> +		return -EINVAL;
>> +	}
>> +
>>   	if (subprog[0].tail_call_reachable)
>>   		env->prog->aux->tail_call_reachable = true;