Re: [PATCH bpf-next 10/17] bpf: Recognize pointers to functions in read-only maps

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Tue, Sep 22, 2026 at 01:31 AM sashiko-bot@kernel.org <sashiko-bot@kernel.org> wrote:
>> +		/*
>> +		 * The program that didn't load is not a user of the map. libbpf
>> +		 * loads the program again to get the log of the verifier.
>> +		 */
>> +		cmpxchg(&map->user, (unsigned long)aux, 0);
>
> [Severity: Medium]
> Will this properly clear the map's user state if the BPF_MAP_USER_PATCHED
> flag was set before a failure?
>
> If jit_subprogs() sets the BPF_MAP_USER_PATCHED flag, map->user becomes
> me | BPF_MAP_USER_PATCHED. If a failure happens afterward, this cmpxchg()
> strictly expects map->user to equal aux, which will fail to match.
>
> This can leave the map permanently locked in the patched state, causing
> libbpf's subsequent reload attempt (to obtain the verifier log) to fail
> with -EBUSY.

No. Not a bug.

>> +		} else if (verifier_bug_if(ptr->used, env, "function of map '%s' offset %u is removed",
>> +					   ptr->map->name, ptr->map_off)) {
>
> [Severity: High]
> Does eagerly setting ptr->used = true in check_func_ptr_read() lead to a
> verifier bug here if the function is never actually called?
>
> If a program simply reads the function pointer from the map but does not
> invoke callx, check_func_ptr_read() still flags it as used. Since the
> subprogram is never called, dead-code elimination can remove it.
>
> When jit_subprogs() later evaluates the deleted but "used" pointer, it
> incorrectly triggers a WARN_ONCE and returns -EFAULT, rejecting a valid
> program.

hmm. A prog can read the pointer and never call the
function, e.g. when the load is hoisted above a branch. Then the
function is dead, 'used' is set and jit_subprogs() hits
verifier_bug_if().
Will follow up with one line fix.