[PATCH bpf-next v4 0/4] Use correct destructor kfunc types

[PATCH bpf-next v4 0/4] Use correct destructor kfunc types

[Sami Tolvanen]

Hi folks,

While running BPF self-tests with CONFIG_CFI (Control Flow
Integrity) enabled, I ran into a couple of failures in
bpf_obj_free_fields() caused by type mismatches between the
btf_dtor_kfunc_t function pointer type and the registered
destructor functions.

It looks like we can't change the argument type for these
functions to match btf_dtor_kfunc_t because the verifier doesn't
like void pointer arguments for functions used in BPF programs,
so this series fixes the issue by adding stubs with correct types
to use as destructors for each instance of this I found in the
kernel tree.

The last patch changes btf_check_dtor_kfuncs() to enforce the
function type when CFI is enabled, so we don't end up registering
destructors that panic the kernel.

Sami

---
v4:
- Rebased on bpf-next/master.
- Renamed CONFIG_CFI_CLANG to CONFIG_CFI.
- Picked up Acked/Tested-by tags.

v3: https://lore.kernel.org/bpf/20250728202656.559071-6-samitolvanen@google.com/
- Renamed the functions and went back to __bpf_kfunc based
  on review feedback.

v2: https://lore.kernel.org/bpf/20250725214401.1475224-6-samitolvanen@google.com/
- Annotated the stubs with CFI_NOSEAL to fix issues with IBT
  sealing on x86.
- Changed __bpf_kfunc to explicit __used __retain.

v1: https://lore.kernel.org/bpf/20250724223225.1481960-6-samitolvanen@google.com/

---
Sami Tolvanen (4):
  bpf: crypto: Use the correct destructor kfunc type
  bpf: net_sched: Use the correct destructor kfunc type
  selftests/bpf: Use the correct destructor kfunc type
  bpf, btf: Enforce destructor kfunc type with CFI

 kernel/bpf/btf.c                                     | 7 +++++++
 kernel/bpf/crypto.c                                  | 8 +++++++-
 net/sched/bpf_qdisc.c                                | 8 +++++++-
 tools/testing/selftests/bpf/test_kmods/bpf_testmod.c | 8 +++++++-
 4 files changed, 28 insertions(+), 3 deletions(-)


base-commit: 688b745401ab16e2e1a3b504863f0a45fd345638
-- 
2.52.0.487.g5c8c507ade-goog

[PATCH bpf-next v4 1/4] bpf: crypto: Use the correct destructor kfunc type

[Sami Tolvanen]

With CONFIG_CFI enabled, the kernel strictly enforces that indirect
function calls use a function pointer type that matches the target
function. I ran into the following type mismatch when running BPF
self-tests:

  CFI failure at bpf_obj_free_fields+0x190/0x238 (target:
    bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc)
  Internal error: Oops - CFI: 00000000f2008228 [#1]  SMP
  ...

As bpf_crypto_ctx_release() is also used in BPF programs and using
a void pointer as the argument would make the verifier unhappy, add
a simple stub function with the correct type and register it as the
destructor kfunc instead.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Tested-by: Viktor Malik <vmalik@redhat.com>
---
 kernel/bpf/crypto.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c
index 83c4d9943084..1d024fe7248a 100644
--- a/kernel/bpf/crypto.c
+++ b/kernel/bpf/crypto.c
@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx)
 		call_rcu(&ctx->rcu, crypto_free_cb);
 }
 
+__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx)
+{
+	bpf_crypto_ctx_release(ctx);
+}
+CFI_NOSEAL(bpf_crypto_ctx_release_dtor);
+
 static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx,
 			    const struct bpf_dynptr_kern *src,
 			    const struct bpf_dynptr_kern *dst,
@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = {
 
 BTF_ID_LIST(bpf_crypto_dtor_ids)
 BTF_ID(struct, bpf_crypto_ctx)
-BTF_ID(func, bpf_crypto_ctx_release)
+BTF_ID(func, bpf_crypto_ctx_release_dtor)
 
 static int __init crypto_kfunc_init(void)
 {
-- 
2.52.0.487.g5c8c507ade-goog

[PATCH bpf-next v4 2/4] bpf: net_sched: Use the correct destructor kfunc type

[Sami Tolvanen]

With CONFIG_CFI enabled, the kernel strictly enforces that indirect
function calls use a function pointer type that matches the
target function. As bpf_kfree_skb() signature differs from the
btf_dtor_kfunc_t pointer type used for the destructor calls in
bpf_obj_free_fields(), add a stub function with the correct type to
fix the type mismatch.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
---
 net/sched/bpf_qdisc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c
index adcb618a2bfc..e9bea9890777 100644
--- a/net/sched/bpf_qdisc.c
+++ b/net/sched/bpf_qdisc.c
@@ -202,6 +202,12 @@ __bpf_kfunc void bpf_kfree_skb(struct sk_buff *skb)
 	kfree_skb(skb);
 }
 
+__bpf_kfunc void bpf_kfree_skb_dtor(void *skb)
+{
+	bpf_kfree_skb(skb);
+}
+CFI_NOSEAL(bpf_kfree_skb_dtor);
+
 /* bpf_qdisc_skb_drop - Drop an skb by adding it to a deferred free list.
  * @skb: The skb whose reference to be released and dropped.
  * @to_free_list: The list of skbs to be dropped.
@@ -449,7 +455,7 @@ static struct bpf_struct_ops bpf_Qdisc_ops = {
 	.owner = THIS_MODULE,
 };
 
-BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb)
+BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb_dtor)
 
 static int __init bpf_qdisc_kfunc_init(void)
 {
-- 
2.52.0.487.g5c8c507ade-goog

[PATCH bpf-next v4 3/4] selftests/bpf: Use the correct destructor kfunc type

[Sami Tolvanen]

With CONFIG_CFI enabled, the kernel strictly enforces that indirect
function calls use a function pointer type that matches the target
function. As bpf_testmod_ctx_release() signature differs from the
btf_dtor_kfunc_t pointer type used for the destructor calls in
bpf_obj_free_fields(), add a stub function with the correct type to
fix the type mismatch.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
---
 tools/testing/selftests/bpf/test_kmods/bpf_testmod.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index ed0a4721d8fd..bf8f6b2591c1 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -285,6 +285,12 @@ __bpf_kfunc void bpf_testmod_ctx_release(struct bpf_testmod_ctx *ctx)
 		call_rcu(&ctx->rcu, testmod_free_cb);
 }
 
+__bpf_kfunc void bpf_testmod_ctx_release_dtor(void *ctx)
+{
+	bpf_testmod_ctx_release(ctx);
+}
+CFI_NOSEAL(bpf_testmod_ctx_release_dtor);
+
 static struct bpf_testmod_ops3 *st_ops3;
 
 static int bpf_testmod_test_3(void)
@@ -707,7 +713,7 @@ BTF_KFUNCS_END(bpf_testmod_common_kfunc_ids)
 
 BTF_ID_LIST(bpf_testmod_dtor_ids)
 BTF_ID(struct, bpf_testmod_ctx)
-BTF_ID(func, bpf_testmod_ctx_release)
+BTF_ID(func, bpf_testmod_ctx_release_dtor)
 
 static const struct btf_kfunc_id_set bpf_testmod_common_kfunc_set = {
 	.owner = THIS_MODULE,
-- 
2.52.0.487.g5c8c507ade-goog

[PATCH bpf-next v4 4/4] bpf, btf: Enforce destructor kfunc type with CFI

[Sami Tolvanen]

Ensure that registered destructor kfuncs have the same type
as btf_dtor_kfunc_t to avoid a kernel panic on systems with
CONFIG_CFI enabled.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
---
 kernel/bpf/btf.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 0de8fc8a0e0b..0346658172ec 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -8845,6 +8845,13 @@ static int btf_check_dtor_kfuncs(struct btf *btf, const struct btf_id_dtor_kfunc
 		 */
 		if (!t || !btf_type_is_ptr(t))
 			return -EINVAL;
+
+		if (IS_ENABLED(CONFIG_CFI_CLANG)) {
+			/* Ensure the destructor kfunc type matches btf_dtor_kfunc_t */
+			t = btf_type_by_id(btf, t->type);
+			if (!btf_type_is_void(t))
+				return -EINVAL;
+		}
 	}
 	return 0;
 }
-- 
2.52.0.487.g5c8c507ade-goog

Re: [PATCH bpf-next v4 0/4] Use correct destructor kfunc types

[Viktor Malik]

On 11/26/25 23:17, Sami Tolvanen wrote:
> Hi folks,
> 
> While running BPF self-tests with CONFIG_CFI (Control Flow
> Integrity) enabled, I ran into a couple of failures in
> bpf_obj_free_fields() caused by type mismatches between the
> btf_dtor_kfunc_t function pointer type and the registered
> destructor functions.
> 
> It looks like we can't change the argument type for these
> functions to match btf_dtor_kfunc_t because the verifier doesn't
> like void pointer arguments for functions used in BPF programs,
> so this series fixes the issue by adding stubs with correct types
> to use as destructors for each instance of this I found in the
> kernel tree.
> 
> The last patch changes btf_check_dtor_kfuncs() to enforce the
> function type when CFI is enabled, so we don't end up registering
> destructors that panic the kernel.

Hi,

this seems to have slipped through the cracks so I'm bumping the thread.
It would be nice if we could merge this.

Thanks.
Viktor

> 
> Sami
> 
> ---
> v4:
> - Rebased on bpf-next/master.
> - Renamed CONFIG_CFI_CLANG to CONFIG_CFI.
> - Picked up Acked/Tested-by tags.
> 
> v3: https://lore.kernel.org/bpf/20250728202656.559071-6-samitolvanen@google.com/
> - Renamed the functions and went back to __bpf_kfunc based
>   on review feedback.
> 
> v2: https://lore.kernel.org/bpf/20250725214401.1475224-6-samitolvanen@google.com/
> - Annotated the stubs with CFI_NOSEAL to fix issues with IBT
>   sealing on x86.
> - Changed __bpf_kfunc to explicit __used __retain.
> 
> v1: https://lore.kernel.org/bpf/20250724223225.1481960-6-samitolvanen@google.com/
> 
> ---
> Sami Tolvanen (4):
>   bpf: crypto: Use the correct destructor kfunc type
>   bpf: net_sched: Use the correct destructor kfunc type
>   selftests/bpf: Use the correct destructor kfunc type
>   bpf, btf: Enforce destructor kfunc type with CFI
> 
>  kernel/bpf/btf.c                                     | 7 +++++++
>  kernel/bpf/crypto.c                                  | 8 +++++++-
>  net/sched/bpf_qdisc.c                                | 8 +++++++-
>  tools/testing/selftests/bpf/test_kmods/bpf_testmod.c | 8 +++++++-
>  4 files changed, 28 insertions(+), 3 deletions(-)
> 
> 
> base-commit: 688b745401ab16e2e1a3b504863f0a45fd345638

Re: [PATCH bpf-next v4 0/4] Use correct destructor kfunc types

[Alexei Starovoitov]

On Mon, Jan 5, 2026 at 5:56 AM Viktor Malik <vmalik@redhat.com> wrote:
>
> On 11/26/25 23:17, Sami Tolvanen wrote:
> > Hi folks,
> >
> > While running BPF self-tests with CONFIG_CFI (Control Flow
> > Integrity) enabled, I ran into a couple of failures in
> > bpf_obj_free_fields() caused by type mismatches between the
> > btf_dtor_kfunc_t function pointer type and the registered
> > destructor functions.
> >
> > It looks like we can't change the argument type for these
> > functions to match btf_dtor_kfunc_t because the verifier doesn't
> > like void pointer arguments for functions used in BPF programs,
> > so this series fixes the issue by adding stubs with correct types
> > to use as destructors for each instance of this I found in the
> > kernel tree.
> >
> > The last patch changes btf_check_dtor_kfuncs() to enforce the
> > function type when CFI is enabled, so we don't end up registering
> > destructors that panic the kernel.
>
> Hi,
>
> this seems to have slipped through the cracks so I'm bumping the thread.
> It would be nice if we could merge this.

It did. Please rebase, resend.

Re: [PATCH bpf-next v4 0/4] Use correct destructor kfunc types

[Viktor Malik]

On 1/5/26 17:16, Alexei Starovoitov wrote:
> On Mon, Jan 5, 2026 at 5:56 AM Viktor Malik <vmalik@redhat.com> wrote:
>>
>> On 11/26/25 23:17, Sami Tolvanen wrote:
>>> Hi folks,
>>>
>>> While running BPF self-tests with CONFIG_CFI (Control Flow
>>> Integrity) enabled, I ran into a couple of failures in
>>> bpf_obj_free_fields() caused by type mismatches between the
>>> btf_dtor_kfunc_t function pointer type and the registered
>>> destructor functions.
>>>
>>> It looks like we can't change the argument type for these
>>> functions to match btf_dtor_kfunc_t because the verifier doesn't
>>> like void pointer arguments for functions used in BPF programs,
>>> so this series fixes the issue by adding stubs with correct types
>>> to use as destructors for each instance of this I found in the
>>> kernel tree.
>>>
>>> The last patch changes btf_check_dtor_kfuncs() to enforce the
>>> function type when CFI is enabled, so we don't end up registering
>>> destructors that panic the kernel.
>>
>> Hi,
>>
>> this seems to have slipped through the cracks so I'm bumping the thread.
>> It would be nice if we could merge this.
> 
> It did. Please rebase, resend.

@Sami, could you please rebase and resend?

Thanks!

>