[PATCH v2 bpf-next 0/3] bpf: Reject attaching fexit to __noreturn functions

[PATCH v2 bpf-next 0/3] bpf: Reject attaching fexit to __noreturn functions

[Yafang Shao]

Attaching fexit probes to functions marked with __noreturn may lead to
unpredictable behavior. To avoid this, we will reject attaching probes to
such functions. Currently, there is no ideal solution, so we will hardcode
a check for all __noreturn functions. Since objtool already handles
this, we will leverage its implementation.

Once a more robust solution is found, this workaround can be removed.

v1->v2:
- keep tools/objtool/noreturns.h as is (Josh)
- Add noreturns.h to objtool/sync-check.sh (Josh)
- Add verbose for the reject and simplify the test case (Song)

v1: https://lore.kernel.org/bpf/20250211023359.1570-1-laoar.shao@gmail.com/

Yafang Shao (3):
  objtool: Copy noreturns.h to include/linux
  bpf: Reject attaching fexit to functions annotated with __noreturn
  selftests/bpf: Add selftest for attaching fexit to __noreturn
    functions

 include/linux/noreturns.h                     | 52 +++++++++++++++++++
 kernel/bpf/verifier.c                         | 11 ++++
 tools/objtool/Documentation/objtool.txt       |  3 +-
 tools/objtool/sync-check.sh                   |  2 +
 .../bpf/prog_tests/fexit_noreturns.c          |  9 ++++
 .../selftests/bpf/progs/fexit_noreturns.c     | 15 ++++++
 6 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 include/linux/noreturns.h
 create mode 100644 tools/testing/selftests/bpf/prog_tests/fexit_noreturns.c
 create mode 100644 tools/testing/selftests/bpf/progs/fexit_noreturns.c

-- 
2.43.5

[PATCH v2 bpf-next 1/3] objtool: Copy noreturns.h to include/linux

[Yafang Shao]

It will used by bpf to reject attaching fexit prog to functions
annotated with __noreturn.

Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
 include/linux/noreturns.h               | 52 +++++++++++++++++++++++++
 tools/objtool/Documentation/objtool.txt |  3 +-
 tools/objtool/sync-check.sh             |  2 +
 3 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 include/linux/noreturns.h

diff --git a/include/linux/noreturns.h b/include/linux/noreturns.h
new file mode 100644
index 000000000000..b2174894f9f7
--- /dev/null
+++ b/include/linux/noreturns.h
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * This is a (sorted!) list of all known __noreturn functions in the kernel.
+ * It's needed for objtool to properly reverse-engineer the control flow graph.
+ *
+ * Yes, this is unfortunate.  A better solution is in the works.
+ */
+NORETURN(__fortify_panic)
+NORETURN(__ia32_sys_exit)
+NORETURN(__ia32_sys_exit_group)
+NORETURN(__kunit_abort)
+NORETURN(__module_put_and_kthread_exit)
+NORETURN(__stack_chk_fail)
+NORETURN(__tdx_hypercall_failed)
+NORETURN(__ubsan_handle_builtin_unreachable)
+NORETURN(__x64_sys_exit)
+NORETURN(__x64_sys_exit_group)
+NORETURN(arch_cpu_idle_dead)
+NORETURN(bch2_trans_in_restart_error)
+NORETURN(bch2_trans_restart_error)
+NORETURN(bch2_trans_unlocked_error)
+NORETURN(cpu_bringup_and_idle)
+NORETURN(cpu_startup_entry)
+NORETURN(do_exit)
+NORETURN(do_group_exit)
+NORETURN(do_task_dead)
+NORETURN(ex_handler_msr_mce)
+NORETURN(hlt_play_dead)
+NORETURN(hv_ghcb_terminate)
+NORETURN(kthread_complete_and_exit)
+NORETURN(kthread_exit)
+NORETURN(kunit_try_catch_throw)
+NORETURN(machine_real_restart)
+NORETURN(make_task_dead)
+NORETURN(mpt_halt_firmware)
+NORETURN(nmi_panic_self_stop)
+NORETURN(panic)
+NORETURN(panic_smp_self_stop)
+NORETURN(rest_init)
+NORETURN(rewind_stack_and_make_dead)
+NORETURN(rust_begin_unwind)
+NORETURN(rust_helper_BUG)
+NORETURN(sev_es_terminate)
+NORETURN(snp_abort)
+NORETURN(start_kernel)
+NORETURN(stop_this_cpu)
+NORETURN(usercopy_abort)
+NORETURN(x86_64_start_kernel)
+NORETURN(x86_64_start_reservations)
+NORETURN(xen_cpu_bringup_again)
+NORETURN(xen_start_kernel)
diff --git a/tools/objtool/Documentation/objtool.txt b/tools/objtool/Documentation/objtool.txt
index 7c3ee959b63c..70a878e4dc36 100644
--- a/tools/objtool/Documentation/objtool.txt
+++ b/tools/objtool/Documentation/objtool.txt
@@ -326,7 +326,8 @@ the objtool maintainers.
 
    The call from foo() to bar() doesn't return, but bar() is missing the
    __noreturn annotation.  NOTE: In addition to annotating the function
-   with __noreturn, please also add it to tools/objtool/noreturns.h.
+   with __noreturn, please also add it to tools/objtool/noreturns.h and
+   include/linux/noreturns.h.
 
 4. file.o: warning: objtool: func(): can't find starting instruction
    or
diff --git a/tools/objtool/sync-check.sh b/tools/objtool/sync-check.sh
index 81d120d05442..23b9813cd5e9 100755
--- a/tools/objtool/sync-check.sh
+++ b/tools/objtool/sync-check.sh
@@ -17,6 +17,7 @@ arch/x86/include/asm/emulate_prefix.h
 arch/x86/lib/x86-opcode-map.txt
 arch/x86/tools/gen-insn-attr-x86.awk
 include/linux/static_call_types.h
+tools/objtool/noreturns.h
 "
 
 SYNC_CHECK_FILES='
@@ -24,6 +25,7 @@ arch/x86/include/asm/inat.h
 arch/x86/include/asm/insn.h
 arch/x86/lib/inat.c
 arch/x86/lib/insn.c
+include/linux/noreturns.h
 '
 fi
 
-- 
2.43.5

[PATCH v2 bpf-next 2/3] bpf: Reject attaching fexit to functions annotated with __noreturn

[Yafang Shao]

If we attach fexit to a function annotated with __noreturn, it will
cause an issue that the bpf trampoline image will be left over even if
the bpf link has been destroyed. Take attaching do_exit() for example. The
fexit works as follows,

  bpf_trampoline
  + __bpf_tramp_enter
    + percpu_ref_get(&tr->pcref);

  + call do_exit()

  + __bpf_tramp_exit
    + percpu_ref_put(&tr->pcref);

Since do_exit() never returns, the refcnt of the trampoline image is
never decremented, preventing it from being freed. That can be verified
with as follows,

  $ bpftool link show                                   <<<< nothing output
  $ grep "bpf_trampoline_[0-9]" /proc/kallsyms
  ffffffffc04cb000 t bpf_trampoline_6442526459    [bpf] <<<< leftover

With this change, attaching fexit probes to functions like do_exit() will
be rejected.

$ ./fexit
libbpf: prog 'fexit': BPF program load failed: -EINVAL
libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG --
Attaching fexit to __noreturn functions is rejected.

Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
 kernel/bpf/verifier.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9971c03adfd5..329af451c936 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -22841,6 +22841,13 @@ BTF_ID(func, __rcu_read_unlock)
 #endif
 BTF_SET_END(btf_id_deny)
 
+/* The functions annotated with __noreturn are denied. */
+BTF_SET_START(fexit_deny)
+#define NORETURN(fn) BTF_ID(func, fn)
+#include <linux/noreturns.h>
+#undef NORETURN
+BTF_SET_END(fexit_deny)
+
 static bool can_be_sleepable(struct bpf_prog *prog)
 {
 	if (prog->type == BPF_PROG_TYPE_TRACING) {
@@ -22929,6 +22936,10 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
 	} else if (prog->type == BPF_PROG_TYPE_TRACING &&
 		   btf_id_set_contains(&btf_id_deny, btf_id)) {
 		return -EINVAL;
+	} else if (prog->expected_attach_type == BPF_TRACE_FEXIT &&
+		   btf_id_set_contains(&fexit_deny, btf_id)) {
+		verbose(env, "Attaching fexit to __noreturn functions is rejected.\n");
+		return -EINVAL;
 	}
 
 	key = bpf_trampoline_compute_key(tgt_prog, prog->aux->attach_btf, btf_id);
-- 
2.43.5

[PATCH v2 bpf-next 3/3] selftests/bpf: Add selftest for attaching fexit to __noreturn functions

[Yafang Shao]

The reuslt:

  $ tools/testing/selftests/bpf/test_progs --name=fexit_noreturns
  #99/1    fexit_noreturns/noreturns:OK
  #99      fexit_noreturns:OK
  Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
 .../selftests/bpf/prog_tests/fexit_noreturns.c    |  9 +++++++++
 .../testing/selftests/bpf/progs/fexit_noreturns.c | 15 +++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/fexit_noreturns.c
 create mode 100644 tools/testing/selftests/bpf/progs/fexit_noreturns.c

diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_noreturns.c b/tools/testing/selftests/bpf/prog_tests/fexit_noreturns.c
new file mode 100644
index 000000000000..568d3aa48a78
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/fexit_noreturns.c
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+#include "fexit_noreturns.skel.h"
+
+void test_fexit_noreturns(void)
+{
+	RUN_TESTS(fexit_noreturns);
+}
diff --git a/tools/testing/selftests/bpf/progs/fexit_noreturns.c b/tools/testing/selftests/bpf/progs/fexit_noreturns.c
new file mode 100644
index 000000000000..a8d25b21f7c2
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/fexit_noreturns.c
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+SEC("fexit/do_exit")
+__failure __msg("Attaching fexit to __noreturn functions is rejected.")
+int BPF_PROG(noreturns)
+{
+	return 0;
+}
-- 
2.43.5

Re: [PATCH v2 bpf-next 1/3] objtool: Copy noreturns.h to include/linux

[kernel test robot]

Hi Yafang,

kernel test robot noticed the following build errors:

[auto build test ERROR on bpf-next/master]

url:    https://github.com/intel-lab-lkp/linux/commits/Yafang-Shao/objtool-Copy-noreturns-h-to-include-linux/20250223-143010
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link:    https://lore.kernel.org/r/20250223062735.3341-2-laoar.shao%40gmail.com
patch subject: [PATCH v2 bpf-next 1/3] objtool: Copy noreturns.h to include/linux
reproduce: (https://download.01.org/0day-ci/archive/20250223/202502231624.0BVpxwbg-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202502231624.0BVpxwbg-lkp@intel.com/

All errors (new ones prefixed by >>):

         |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   1 error generated.
   make[2]: *** [scripts/Makefile.build:102: scripts/mod/devicetable-offsets.s] Error 1
   make[2]: Target 'scripts/mod/' not remade because of errors.
   make[1]: *** [Makefile:1263: prepare0] Error 2
>> diff: tools/tools/objtool/noreturns.h: No such file or directory
   Warning: Kernel ABI header at 'tools/tools/objtool/noreturns.h' differs from latest version at 'tools/objtool/noreturns.h'
   make[3]: *** [Makefile:70: tools/objtool/objtool-in.o] Error 1
   make[3]: Target 'all' not remade because of errors.
   make[2]: *** [Makefile:73: objtool] Error 2
   make[1]: *** [Makefile:1430: tools/objtool] Error 2

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v2 bpf-next 1/3] objtool: Copy noreturns.h to include/linux

[Alexei Starovoitov]

On Sat, Feb 22, 2025 at 10:28 PM Yafang Shao <laoar.shao@gmail.com> wrote:
>
> It will used by bpf to reject attaching fexit prog to functions
> annotated with __noreturn.
>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> ---
>  include/linux/noreturns.h               | 52 +++++++++++++++++++++++++
>  tools/objtool/Documentation/objtool.txt |  3 +-
>  tools/objtool/sync-check.sh             |  2 +
>  3 files changed, 56 insertions(+), 1 deletion(-)
>  create mode 100644 include/linux/noreturns.h
>
> diff --git a/include/linux/noreturns.h b/include/linux/noreturns.h
> new file mode 100644
> index 000000000000..b2174894f9f7
> --- /dev/null
> +++ b/include/linux/noreturns.h
> @@ -0,0 +1,52 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +/*
> + * This is a (sorted!) list of all known __noreturn functions in the kernel.
> + * It's needed for objtool to properly reverse-engineer the control flow graph.
> + *
> + * Yes, this is unfortunate.  A better solution is in the works.
> + */
> +NORETURN(__fortify_panic)
> +NORETURN(__ia32_sys_exit)
> +NORETURN(__ia32_sys_exit_group)
> +NORETURN(__kunit_abort)
> +NORETURN(__module_put_and_kthread_exit)
> +NORETURN(__stack_chk_fail)
> +NORETURN(__tdx_hypercall_failed)
> +NORETURN(__ubsan_handle_builtin_unreachable)
> +NORETURN(__x64_sys_exit)
> +NORETURN(__x64_sys_exit_group)
> +NORETURN(arch_cpu_idle_dead)
> +NORETURN(bch2_trans_in_restart_error)
> +NORETURN(bch2_trans_restart_error)
> +NORETURN(bch2_trans_unlocked_error)
> +NORETURN(cpu_bringup_and_idle)
> +NORETURN(cpu_startup_entry)
> +NORETURN(do_exit)
> +NORETURN(do_group_exit)
> +NORETURN(do_task_dead)
> +NORETURN(ex_handler_msr_mce)
> +NORETURN(hlt_play_dead)
> +NORETURN(hv_ghcb_terminate)
> +NORETURN(kthread_complete_and_exit)
> +NORETURN(kthread_exit)
> +NORETURN(kunit_try_catch_throw)
> +NORETURN(machine_real_restart)
> +NORETURN(make_task_dead)
> +NORETURN(mpt_halt_firmware)
> +NORETURN(nmi_panic_self_stop)
> +NORETURN(panic)
> +NORETURN(panic_smp_self_stop)
> +NORETURN(rest_init)
> +NORETURN(rewind_stack_and_make_dead)
> +NORETURN(rust_begin_unwind)
> +NORETURN(rust_helper_BUG)
> +NORETURN(sev_es_terminate)
> +NORETURN(snp_abort)
> +NORETURN(start_kernel)
> +NORETURN(stop_this_cpu)
> +NORETURN(usercopy_abort)
> +NORETURN(x86_64_start_kernel)
> +NORETURN(x86_64_start_reservations)
> +NORETURN(xen_cpu_bringup_again)
> +NORETURN(xen_start_kernel)
> diff --git a/tools/objtool/Documentation/objtool.txt b/tools/objtool/Documentation/objtool.txt
> index 7c3ee959b63c..70a878e4dc36 100644
> --- a/tools/objtool/Documentation/objtool.txt
> +++ b/tools/objtool/Documentation/objtool.txt
> @@ -326,7 +326,8 @@ the objtool maintainers.
>
>     The call from foo() to bar() doesn't return, but bar() is missing the
>     __noreturn annotation.  NOTE: In addition to annotating the function
> -   with __noreturn, please also add it to tools/objtool/noreturns.h.
> +   with __noreturn, please also add it to tools/objtool/noreturns.h and
> +   include/linux/noreturns.h.
>
>  4. file.o: warning: objtool: func(): can't find starting instruction
>     or
> diff --git a/tools/objtool/sync-check.sh b/tools/objtool/sync-check.sh
> index 81d120d05442..23b9813cd5e9 100755
> --- a/tools/objtool/sync-check.sh
> +++ b/tools/objtool/sync-check.sh
> @@ -17,6 +17,7 @@ arch/x86/include/asm/emulate_prefix.h
>  arch/x86/lib/x86-opcode-map.txt
>  arch/x86/tools/gen-insn-attr-x86.awk
>  include/linux/static_call_types.h
> +tools/objtool/noreturns.h
>  "
>
>  SYNC_CHECK_FILES='
> @@ -24,6 +25,7 @@ arch/x86/include/asm/inat.h
>  arch/x86/include/asm/insn.h
>  arch/x86/lib/inat.c
>  arch/x86/lib/insn.c
> +include/linux/noreturns.h

The copy looks pointless.
Since we cannot rely on objtool let's just list all noreturn funcs
directly in BTF_SET_START(fexit_deny) in a single patch.
So all changes will be under kernel/bpf directory.

pw-bot: cr

Re: [PATCH v2 bpf-next 1/3] objtool: Copy noreturns.h to include/linux

[Yafang Shao]

On Mon, Feb 24, 2025 at 4:12 AM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Sat, Feb 22, 2025 at 10:28 PM Yafang Shao <laoar.shao@gmail.com> wrote:
> >
> > It will used by bpf to reject attaching fexit prog to functions
> > annotated with __noreturn.
> >
> > Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> > ---
> >  include/linux/noreturns.h               | 52 +++++++++++++++++++++++++
> >  tools/objtool/Documentation/objtool.txt |  3 +-
> >  tools/objtool/sync-check.sh             |  2 +
> >  3 files changed, 56 insertions(+), 1 deletion(-)
> >  create mode 100644 include/linux/noreturns.h
> >
> > diff --git a/include/linux/noreturns.h b/include/linux/noreturns.h
> > new file mode 100644
> > index 000000000000..b2174894f9f7
> > --- /dev/null
> > +++ b/include/linux/noreturns.h
> > @@ -0,0 +1,52 @@
> > +/* SPDX-License-Identifier: GPL-2.0 */
> > +
> > +/*
> > + * This is a (sorted!) list of all known __noreturn functions in the kernel.
> > + * It's needed for objtool to properly reverse-engineer the control flow graph.
> > + *
> > + * Yes, this is unfortunate.  A better solution is in the works.
> > + */
> > +NORETURN(__fortify_panic)
> > +NORETURN(__ia32_sys_exit)
> > +NORETURN(__ia32_sys_exit_group)
> > +NORETURN(__kunit_abort)
> > +NORETURN(__module_put_and_kthread_exit)
> > +NORETURN(__stack_chk_fail)
> > +NORETURN(__tdx_hypercall_failed)
> > +NORETURN(__ubsan_handle_builtin_unreachable)
> > +NORETURN(__x64_sys_exit)
> > +NORETURN(__x64_sys_exit_group)
> > +NORETURN(arch_cpu_idle_dead)
> > +NORETURN(bch2_trans_in_restart_error)
> > +NORETURN(bch2_trans_restart_error)
> > +NORETURN(bch2_trans_unlocked_error)
> > +NORETURN(cpu_bringup_and_idle)
> > +NORETURN(cpu_startup_entry)
> > +NORETURN(do_exit)
> > +NORETURN(do_group_exit)
> > +NORETURN(do_task_dead)
> > +NORETURN(ex_handler_msr_mce)
> > +NORETURN(hlt_play_dead)
> > +NORETURN(hv_ghcb_terminate)
> > +NORETURN(kthread_complete_and_exit)
> > +NORETURN(kthread_exit)
> > +NORETURN(kunit_try_catch_throw)
> > +NORETURN(machine_real_restart)
> > +NORETURN(make_task_dead)
> > +NORETURN(mpt_halt_firmware)
> > +NORETURN(nmi_panic_self_stop)
> > +NORETURN(panic)
> > +NORETURN(panic_smp_self_stop)
> > +NORETURN(rest_init)
> > +NORETURN(rewind_stack_and_make_dead)
> > +NORETURN(rust_begin_unwind)
> > +NORETURN(rust_helper_BUG)
> > +NORETURN(sev_es_terminate)
> > +NORETURN(snp_abort)
> > +NORETURN(start_kernel)
> > +NORETURN(stop_this_cpu)
> > +NORETURN(usercopy_abort)
> > +NORETURN(x86_64_start_kernel)
> > +NORETURN(x86_64_start_reservations)
> > +NORETURN(xen_cpu_bringup_again)
> > +NORETURN(xen_start_kernel)
> > diff --git a/tools/objtool/Documentation/objtool.txt b/tools/objtool/Documentation/objtool.txt
> > index 7c3ee959b63c..70a878e4dc36 100644
> > --- a/tools/objtool/Documentation/objtool.txt
> > +++ b/tools/objtool/Documentation/objtool.txt
> > @@ -326,7 +326,8 @@ the objtool maintainers.
> >
> >     The call from foo() to bar() doesn't return, but bar() is missing the
> >     __noreturn annotation.  NOTE: In addition to annotating the function
> > -   with __noreturn, please also add it to tools/objtool/noreturns.h.
> > +   with __noreturn, please also add it to tools/objtool/noreturns.h and
> > +   include/linux/noreturns.h.
> >
> >  4. file.o: warning: objtool: func(): can't find starting instruction
> >     or
> > diff --git a/tools/objtool/sync-check.sh b/tools/objtool/sync-check.sh
> > index 81d120d05442..23b9813cd5e9 100755
> > --- a/tools/objtool/sync-check.sh
> > +++ b/tools/objtool/sync-check.sh
> > @@ -17,6 +17,7 @@ arch/x86/include/asm/emulate_prefix.h
> >  arch/x86/lib/x86-opcode-map.txt
> >  arch/x86/tools/gen-insn-attr-x86.awk
> >  include/linux/static_call_types.h
> > +tools/objtool/noreturns.h
> >  "
> >
> >  SYNC_CHECK_FILES='
> > @@ -24,6 +25,7 @@ arch/x86/include/asm/inat.h
> >  arch/x86/include/asm/insn.h
> >  arch/x86/lib/inat.c
> >  arch/x86/lib/insn.c
> > +include/linux/noreturns.h
>
> The copy looks pointless.
> Since we cannot rely on objtool let's just list all noreturn funcs
> directly in BTF_SET_START(fexit_deny) in a single patch.
> So all changes will be under kernel/bpf directory.

OK
I will send a new version.

-- 
Regards
Yafang