Re: [PATCH bpf-next v4 15/25] bpf: Reject stack arguments if tail call reachable

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Order-dependent verification allows invalid programs combining tail calls and stack arguments to bypass checks.
- [High] Exception and async callbacks bypass the new stack argument and tail call restriction.
--

commit 807349b213e40b7418c45dc1ae2cee5695bf101d
Author: Yonghong Song <yonghong.song@linux.dev>

bpf: Reject stack arguments if tail call reachable

This patch updates the BPF verifier to reject programs that combine tail calls
with stack arguments, as tail calls are deprecated. It hooks into the call
depth traversal to fail verification if stack arguments are present in a
call chain that can reach a tail call.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index a363811aec7a0..47df3f40a71cf 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5267,14 +5267,23 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
>  	 * this info will be utilized by JIT so that we will be preserving the
>  	 * tail call counter throughout bpf2bpf calls combined with tailcalls
>  	 */
> -	if (tail_call_reachable)
> +	if (tail_call_reachable) {
>  		for (tmp = idx; tmp >= 0; tmp = dinfo[tmp].caller) {
>  			if (subprog[tmp].is_exception_cb) {
>  				verbose(env, "cannot tail call within exception cb\n");
>  				return -EINVAL;
>  			}
> +			if (subprog[tmp].stack_arg_cnt) {

Can this check be bypassed depending on the order of subprogram calls?

If a main program calls subprogram A (which uses stack args) and then
subprogram B (which has a tail call), it seems subprogram A might be
evaluated first when tail_call_reachable is false, bypassing this check.

When subprogram B is evaluated, it sets tail_call_reachable to true,
which propagates to the main program.

When the main program finishes, only the main program's stack_arg_cnt is
checked, allowing the program to pass verification.

If the calls were reversed, subprogram A would inherit the true state and
be correctly rejected.

Does this sequence allow invalid programs to bypass the safety check?

> +				verbose(env, "tail_calls are not allowed in programs with stack args\n");
> +				return -EINVAL;
> +			}
>  			subprog[tmp].tail_call_reachable = true;
>  		}
> +	} else if (!idx && subprog[0].has_tail_call && subprog[0].stack_arg_cnt) {

Does this fallback check miss exception and async callbacks?

By explicitly checking !idx and subprog[0], it appears to assume the main
program is the only call graph root.

Since exception and async callbacks are verified independently as their own
root programs (where idx > 0), would a callback that contains a tail call,
uses stack arguments, and makes no BPF-to-BPF calls bypass both the primary
tail_call_reachable check and this fallback check?

> +		verbose(env, "tail_calls are not allowed in programs with stack args\n");
> +		return -EINVAL;
> +	}
> +
>  	if (subprog[0].tail_call_reachable)
>  		env->prog->aux->tail_call_reachable = true;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260513044949.2382019-1-yonghong.song@linux.dev?part=15