Re: [PATCH bpf-next v2 05/20] bpf: Make exception landing pads reachable in the CFG

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: missing prune point at exception landing pad target
--

commit 4fbd0e36862ba7e3ee8480e535068a6821d5cad0
Author: Yonghong Song <yonghong.song@linux.dev>

bpf: Make exception landing pads reachable in the CFG

This commit updates the verifier's control flow graph and liveness analysis
to properly handle exception landing pads. It ensures that exception throwing
calls can reach cleanup records, and prevents outer frame stack slots from
being read incorrectly when control is transferred to landing pads.

> diff --git a/kernel/bpf/cfg.c b/kernel/bpf/cfg.c
> index 842c7d1eabccc..9f8b8b54d5ea7 100644
> --- a/kernel/bpf/cfg.c
> +++ b/kernel/bpf/cfg.c

[ ... ]

> @@ -158,17 +159,57 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env)
>  	return DONE_EXPLORING;
>  }
>  
> +static int visit_cleanup_pad_edge(int t, struct bpf_verifier_env *env)
> +{
> +	int *insn_stack = env->cfg.insn_stack;
> +	int *insn_state = env->cfg.insn_state;
> +	int w;
> +
> +	if (!env->cleanup_info_cnt)
> +		return DONE_EXPLORING;
> +	w = bpf_cleanup_pad_of_call(env, t);
> +	if (w < 0)
> +		return DONE_EXPLORING;
> +
> +	mark_prune_point(env, t);
> +	mark_jmp_point(env, w);
> +	mark_jump_target(env, w);

[Severity: High]
Should mark_prune_point() be applied to the landing pad target w instead of
the call site t?

Because w is a branch target where control flow merges, it needs to be marked
as a prune point so the verifier knows to check for state convergence. By
marking t instead of w, the verifier will evaluate the landing pad and all
subsequent cleanup instructions independently for every exception-throwing
call that branches to w.

Can this lead to combinatorial path explosion and result in the verifier
rejecting the program with -E2BIG?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918044156.3283973-1-yonghong.song@linux.dev?part=5