Re: [PATCH bpf-next v3 2/3] bpf: Reject callback subprogs invoke tailcall

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Direct tail calls inside async and exception callbacks are no longer rejected, bypassing the Tail Call Counter (TCC) limit and potentially causing infinite tail calls or crashes.
--

--- Patch [2]: [PATCH bpf-next v3 2/3] bpf: Reject callback subprogs invoke tailcall ---
commit 99ae0587c85d574b41c654707864af3b7ff51fa8
Author: Pu Lehui <pulehui@huawei.com>

    bpf: Reject callback subprogs invoke tailcall

This commit aims to fix infinite tailcalls by rejecting tailcalls inside
all subprograms of synchronous callbacks. It also consolidates the existing
async and exception callback checks into a single unified check.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 782d939c38cdc..62d46b4c9962f 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5237,10 +5237,6 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
>  		if (verifier_bug_if(sidx < 0, env, "callee not found at insn %d", next_insn))
>  			return -EFAULT;
>  		if (subprog[sidx].is_async_cb) {
> -			if (subprog[sidx].has_tail_call) {
> -				verifier_bug(env, "subprog has tail_call and async cb");
> -				return -EFAULT;
> -			}

[Severity: High]
Does removing this explicit check allow direct tailcalls inside async and
exception callbacks to bypass validation?

If an async or exception callback does not make any subprogram calls (acting
as a root subprogram), the local variable tail_call_reachable will remain
false, as it is only set to true when traversing into or returning from a
callee subprogram.

>  			/* async callbacks don't increase bpf prog stack size unless called directly */
>  			if (!bpf_pseudo_call(insn + i))
>  				continue;
> @@ -5281,8 +5277,8 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
>  	 */
>  	if (tail_call_reachable) {
>  		for (tmp = idx; tmp >= 0; tmp = dinfo[tmp].caller) {
> -			if (subprog[tmp].is_exception_cb) {
> -				verbose(env, "cannot tail call within exception cb\n");
> +			if (subprog[tmp].is_cb) {

Because tail_call_reachable evaluates to false for callbacks without
subprogram calls, will this unified check be completely bypassed?

Since these callbacks are invoked directly by the kernel rather than via a
BPF-to-BPF call, the Tail Call Counter register might be uninitialized. Could
this bypass the TCC limit and lead to infinite tailcalls?

> +				verbose(env, "cannot tail call within callback\n");
>  				return -EINVAL;
>  			}
>  			if (subprog[tmp].stack_arg_cnt) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716120157.835937-1-pulehui@huaweicloud.com?part=2