From: sashiko-bot@kernel.org
To: "Jay Wang" <wanjay@amazon.com>
Cc: gary@garyguo.net, bpf@vger.kernel.org,
linux-modules@vger.kernel.org, ojeda@kernel.org
Subject: Re: [PATCH bpf-next v3 3/9] bpf: fetch the vmlinux BTF where kernel types enter a program
Date: Fri, 25 Sep 2026 23:10:59 +0000 [thread overview]
Message-ID: <20260925231100.6A2481F00893@smtp.kernel.org> (raw)
In-Reply-To: <20260925224229.1850-4-wanjay@amazon.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: state-dependent verification failure for BTF-independent programs
--
commit f6fc508c855b2ee6adf6ef6d3d2ccfe35410bcf1
Author: Jay Wang <wanjay@amazon.com>
bpf: fetch the vmlinux BTF where kernel types enter a program
This commit delays fetching the vmlinux BTF until kernel types actually
enter the verifier state. This prevents unnecessary loading and parsing
of BTF for BTF-independent programs like socket filters, saving memory
and parsing overhead.
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -22532,10 +22580,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
>
> mark_verifier_state_clean(env);
>
> - if (IS_ERR(btf_vmlinux)) {
> + if (IS_ERR(bpf_peek_btf_vmlinux())) {
[Severity: High]
Could this introduce a state-dependent verification failure for
BTF-independent programs?
When a BTF-independent program (like a systemd socket filter) is loaded
initially, the bpf_peek_btf_vmlinux() helper returns a null pointer and this
check is bypassed.
If a BTF-dependent program is later loaded under memory pressure, the
btf_parse_vmlinux() routine could fail with a memory allocation error. When
the kernel is configured with BTF enabled, bpf_get_btf_vmlinux() permanently
stores this error pointer in the global btf_vmlinux variable.
Subsequent loads of completely unrelated, BTF-independent programs will now
see the error pointer returned by bpf_peek_btf_vmlinux() evaluate to true
and fail with an in-kernel BTF is malformed error in bpf_check().
Will this unintentionally cause transient memory failures during BTF parsing
to permanently break unrelated critical system services?
> /* Either gcc or pahole or kernel are broken. */
> verbose(env, "in-kernel BTF is malformed\n");
> - ret = PTR_ERR(btf_vmlinux);
> + ret = PTR_ERR(bpf_peek_btf_vmlinux());
> goto skip_full_check;
> }
>
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260925224229.1850-1-wanjay@amazon.com?part=3
next prev parent reply other threads:[~2026-09-25 23:11 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-25 22:42 [PATCH bpf-next v3 0/9] bpf: make the vmlinux BTF an on-demand loadable module (CONFIG_DEBUG_INFO_BTF=m) to save ~5.4 MB memory Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 1/9] bpf: pass the vmlinux BTF to btf_parse_module() and let it adopt the data Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 2/9] bpf: split the kfunc, dtor kfunc and struct_ops registration bodies Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 3/9] bpf: fetch the vmlinux BTF where kernel types enter a program Jay Wang
2026-09-25 23:10 ` sashiko-bot [this message]
2026-10-01 23:51 ` Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 4/9] bpf: take the vmlinux BTF from the btf_vmlinux module Jay Wang
2026-09-25 23:23 ` bot+bpf-ci
2026-10-01 23:51 ` Jay Wang
2026-09-26 8:29 ` Alexei Starovoitov
2026-10-01 23:51 ` Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 5/9] bpf: defer vmlinux kfunc and struct_ops registrations Jay Wang
2026-09-25 23:34 ` bot+bpf-ci
2026-10-01 23:52 ` Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 6/9] bpf: keep module BTF until the vmlinux BTF is available Jay Wang
2026-09-25 22:59 ` sashiko-bot
2026-10-01 23:52 ` Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 7/9] bpf: expose deferred .BTF.base module BTF in sysfs from module load Jay Wang
2026-09-25 23:23 ` bot+bpf-ci
2026-10-01 23:52 ` Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 8/9] bpf, trace, net: prepare CONFIG_DEBUG_INFO_BTF checks for a tristate Jay Wang
2026-09-25 23:23 ` bot+bpf-ci
2026-10-01 23:53 ` Jay Wang
2026-09-25 22:42 ` [PATCH bpf-next v3 9/9] kbuild, bpf: allow building the vmlinux BTF as a module Jay Wang
2026-09-25 23:34 ` bot+bpf-ci
2026-10-01 23:53 ` Jay Wang
2026-09-28 10:00 ` Alan Maguire
[not found] ` <DM6PR18MB2666F6B235D5B356AA157A7DA98D2@DM6PR18MB2666.namprd18.prod.outlook.com>
2026-09-29 18:25 ` Alan Maguire
2026-10-01 23:53 ` Jay Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260925231100.6A2481F00893@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=gary@garyguo.net \
--cc=linux-modules@vger.kernel.org \
--cc=ojeda@kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=wanjay@amazon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox