Re: [PATCH bpf-next v2 1/2] bpf: Print breakdown of insns processed by subprogs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Out-of-bounds array read of `env->prog->aux->func_info_aux` in `bpf_subprog_is_global` during `print_verification_stats`.
--

commit ef2118bdc82dd49b98dca03db90f551c13fc5d86
Author: Paul Chaignon <paul.chaignon@gmail.com>

bpf: Print breakdown of insns processed by subprogs

When using global functions, the verifier performs function-by-function
verification, and only the sum of instructions processed is reported.
This patch implements a breakdown of instructions processed per global
function under BPF_LOG_STATS, as is done for stack depths.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -18288,6 +18295,13 @@ static void print_verification_stats(struct bpf_verifier_env *env)
>  				verbose(env, "+");
>  		}
>  		verbose(env, "\n");
> +		verbose(env, "insns processed %d", env->subprog_info[0].insn_processed);
> +		for (i = 1; i < env->subprog_cnt; i++) {
> +			if (!bpf_subprog_is_global(env, i))

Does this code cause an out-of-bounds read of the func_info_aux array?

If a default exception callback is injected during verification,
add_hidden_subprog() increments env->subprog_cnt but does not resize the
func_info_aux array.

When print_verification_stats() later iterates up to the new env->subprog_cnt
and calls bpf_subprog_is_global(env, i):

kernel/bpf/verifier.c:bpf_subprog_is_global() {
	struct bpf_func_info_aux *aux = env->prog->aux->func_info_aux;

	return aux && aux[subprog].linkage == BTF_FUNC_GLOBAL;
}

Could this read past the end of the aux array when i reaches the index of
the newly added hidden subprogram?

> +				continue;
> +			verbose(env, "+%d", env->subprog_info[i].insn_processed);
> +		}
> +		verbose(env, "\n");
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/5c3514dbc879f22ba3f9eff8a2c730e13bd0572c.1777398528.git.paul.chaignon@gmail.com?part=1