Re: [PATCH bpf-next 1/2] bpf: Reject callback subprogs invoke tailcall

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Security / Logic Bypass: Direct tail calls in async and exception callbacks bypass the verifier restrictions.
- [Medium] Spurious Verifier Rejection (False Positive): Valid BPF programs combining tail calls and sync callbacks are incorrectly rejected.
--

--- Patch [1]: [PATCH bpf-next 1/2] bpf: Reject callback subprogs invoke tailcall ---
commit 0cf6a6c653bf111f813aea810bb3fffbfc857ff7
Author: Pu Lehui <pulehui@huawei.com>

bpf: Reject callback subprogs invoke tailcall

The commit rejects tailcalls inside all subprograms of sync callbacks to
prevent infinite tailcalls caused by register clobbering. It also cleanly
consolidates the existing async and exception callback checks into a single
unified validation.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 03e2202cca13d..3f6c8b8fc04d0 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5258,10 +5258,6 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
>  		if (verifier_bug_if(sidx < 0, env, "callee not found at insn %d", next_insn))
>  			return -EFAULT;
>  		if (subprog[sidx].is_async_cb) {
> -			if (subprog[sidx].has_tail_call) {
> -				verifier_bug(env, "subprog has tail_call and async cb");
> -				return -EFAULT;
> -			}

[Severity: High]
Does removing this check allow async and exception callbacks with direct
tail calls to bypass verifier restrictions?

Because tail_call_reachable is initialized to false at the start of
check_max_stack_depth_subprog(), a direct tail call inside an async
callback (when evaluated as a root subprog) does not trigger the logic
to set tail_call_reachable to true. 

By removing this explicit check, the new validation block below is entirely
bypassed. This seems to allow unprivileged users to bypass the Tail Call
Counter (TCC) limits, potentially leading to runaway infinite tail calls and
kernel hangs.

>  			/* async callbacks don't increase bpf prog stack size unless called directly */
>  			if (!bpf_pseudo_call(insn + i))
>  				continue;

[ ... ]

> @@ -5302,8 +5298,8 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
>  	 */
>  	if (tail_call_reachable) {
>  		for (tmp = idx; tmp >= 0; tmp = dinfo[tmp].caller) {
> -			if (subprog[tmp].is_exception_cb) {
> -				verbose(env, "cannot tail call within exception cb\n");
> +			if (subprog[tmp].is_cb) {
> +				verbose(env, "cannot tail call within callback\n");
>  				return -EINVAL;
>  			}

[Severity: Medium]
Could this unified check spuriously reject valid BPF programs combining
tail calls and sync callbacks?

When the verifier descends into a new subprogram (like a sync callback):

		idx = sidx;
		if (!priv_stack_supported)
			subprog[idx].priv_stack_mode = NO_PRIV_STACK;

		if (subprog[idx].has_tail_call)
			tail_call_reachable = true;

It appears the tail_call_reachable state is not reset to false. If a BPF
program sequentially calls a tail-call-reachable subprogram, and subsequently
passes a synchronous callback to a helper (like bpf_loop), the
tail_call_reachable boolean state from the first call leaks into the
callback's DFS evaluation.

The verifier might then wrongly assume the callback itself is
tail-call-reachable, incorrectly rejecting legitimate programs with -EINVAL.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260711104727.4023420-1-pulehui@huaweicloud.com?part=1