Re: [PATCH bpf-next v1 1/2] bpf: allow terminal gotox instructions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] bpf_throw kfunc is incorrectly rejected as the last instruction of a subprogram.
--

commit 2856cb56c044a060705479701aa63316b773e7de
Author: Siddharth Chintamaneni <sidchintamaneni@gmail.com>

bpf: allow terminal gotox instructions

This commit skips direct-offset validation for gotox instructions in
check_subprogs() and accepts them as non-fallthrough terminal instructions.
The actual targets are validated during CFG construction instead.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index e036ae20bf6b9..44195ec1445d9 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -3106,7 +3108,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
>  			 */
>  			if (code != (BPF_JMP | BPF_EXIT) &&
>  			    code != (BPF_JMP32 | BPF_JA) &&
> -			    code != (BPF_JMP | BPF_JA)) {
> +			    code != (BPF_JMP | BPF_JA) &&
> +			    !insn_is_gotox(&insn[i])) {

[Severity: High]
This isn't a bug introduced by this patch, but does check_subprogs()
incorrectly reject bpf_throw calls when they are used as terminal instructions?

The comment just above this block explicitly states that the last instruction
of the subprogram can be a bpf_throw call.

However, the if condition only allows exits, unconditional jumps, and
gotox instructions.

Because there is no check allowing bpf_throw (like checking if the call is a
throw kfunc), will a valid BPF program ending with a bpf_throw instruction be
incorrectly rejected during load when it hits this validation?

>  				verbose(env, "last insn is not an exit or jmp\n");
>  				bpf_diag_program_structure(
>  					env, i, "subprogram can fall through",

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830073125.360934-1-sidchintamaneni@gmail.com?part=1