From: Yonghong Song <yonghong.song@linux.dev>
To: sashiko-reviews@lists.linux.dev, bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v11 04/26] bpf: Keep a call site's landing pad in insn_aux_data, add lookups
Date: Thu, 15 Oct 2026 08:19:34 -0700 [thread overview]
Message-ID: <2b3389e9-53c0-4437-b5d3-7a11d60f91b7@linux.dev> (raw)
In-Reply-To: <sashiko-outbox-172243@kernel.org>
On 10/14/26 9:16 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf: adjust_insn_aux_data misses cleanup_pad on BPF_PATCH_MOVE_TARGET
> --
>
> commit 407d61973b5e3b7df47dda20c8cb86db0ad2e4ca
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf: Keep a call site's landing pad in insn_aux_data, add lookups
>
> A call site's landing pad, if any, is kept in insn_aux_data as
> cleanup_pad. adjust_insn_aux_data(), which every instruction patch goes
> through, and verifier_remove_insns() keep it in step, and
> bpf_opt_remove_nops() moves a pad off a nop to the next instruction
> before removing the nop. Add lookups for it and for calls to
> bpf_unwind() and bpf_unwind_resume(); their users come in later patches.
>
>> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
>> index b2fa7e8bedf3a..18c563abd988f 100644
>> --- a/kernel/bpf/fixups.c
>> +++ b/kernel/bpf/fixups.c
> [ ... ]
>> @@ -244,11 +244,18 @@ static void adjust_insn_aux_data(struct bpf_verifier_env *env,
>> data[i].non_stack_access =
>> data[off + cnt - 1].non_stack_access;
>> data[off + cnt - 1].non_stack_access = false;
>> + data[i].cleanup_pad = data[off + cnt - 1].cleanup_pad;
>> + data[off + cnt - 1].cleanup_pad = 0;
>> } else if (bpf_is_mem_insn(insn + i)) {
>> data[i].non_stack_access = true;
>> }
>> }
>>
>> + if (env->cleanup_info_cnt)
>> + for (i = 0; i < prog_len; i++)
>> + if (data[i].cleanup_pad > off + 1)
>> + data[i].cleanup_pad += cnt - 1;
>> +
> [Severity: High]
> If bpf_convert_ctx_accesses() inserts a prologue at the start of a subprogram
> (offset 0) by calling __bpf_patch_insn_data() with BPF_PATCH_MOVE_TARGET,
> the original instruction shifts from index 0 down to index cnt - 1.
>
> Because of the strictly greater-than condition here (> off + 1), if a call
> site's landing pad is exactly at offset 0 (cleanup_pad == 1), the condition
> evaluates to false and the index won't be shifted.
>
> Could this cause the cleanup pad to point to the newly inserted prologue
> instead of the intended instruction, potentially leading to stack or
> context corruption during an exception unwind?
As mentioned in previous comments, landing_pad cannot be in the beginning
of a subprogram. For example:
landing_pad_start:
insn 0: r1 = r6
...
call bpf_unwind_resume
The verifier will go to insn 0 and assuming it is NOT in landing_pad
and eventually it will hit bpf_unwind_resume() and the verifier will
reject it since it thinks bpf_unwind_resume() is out of landing pad.
This patch should be okay.
>
next prev parent reply other threads:[~2026-10-15 15:19 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 4:01 [PATCH bpf-next v11 00/26] bpf: Run exception cleanup landing pads when bpf_unwind() unwinds Yonghong Song
2026-10-15 4:01 ` [PATCH bpf-next v11 01/26] bpf: Pack bpf_insn_aux_data flags into bit fields Yonghong Song
2026-10-15 4:01 ` [PATCH bpf-next v11 02/26] bpf: Accept the compiler's exception cleanup table at program load Yonghong Song
2026-10-15 4:01 ` [PATCH bpf-next v11 03/26] bpf: Add the bpf_unwind() and bpf_unwind_resume() kfuncs Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 04/26] bpf: Keep a call site's landing pad in insn_aux_data, add lookups Yonghong Song
2026-10-15 4:16 ` sashiko-bot
2026-10-15 15:19 ` Yonghong Song [this message]
2026-10-15 4:02 ` [PATCH bpf-next v11 05/26] bpf: Mark covered call sites and check a program can take a table Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 06/26] bpf: Make exception landing pads reachable in the CFG Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 07/26] bpf: Verify an unwind through landing pads and epilogues Yonghong Song
2026-10-15 4:29 ` sashiko-bot
2026-10-15 15:43 ` Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 08/26] bpf: Refuse a callback that can unwind Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 09/26] bpf: Refuse a landing pad that does not resume Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 10/26] bpf: Do not use a private stack for a program that can unwind Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 11/26] bpf: Prepare JITed programs for dispatching cleanup pads Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 12/26] bpf: Keep an epilogue for each subprog an unwind can pass through Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 13/26] bpf: Allow a subprog to end with a call that does not return Yonghong Song
2026-10-15 4:02 ` [PATCH bpf-next v11 14/26] bpf: Dispatch cleanup pads by rewriting return addresses Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 15/26] bpf: Refuse a trampoline that calls a subprog that can unwind Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 16/26] bpf, x86: Dispatch exception cleanup pads at run time Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 17/26] bpf, arm64: " Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 18/26] libbpf: Resolve the compiler's _Unwind_Resume to the kernel's kfunc Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 19/26] libbpf: Add cleanup_info to bpf_prog_load_opts Yonghong Song
2026-10-15 4:13 ` sashiko-bot
2026-10-15 15:45 ` Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 20/26] libbpf: Collect .bpf_cleanup records and pass them to the kernel Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 21/26] libbpf: Carry the exception cleanup table through the light skeleton Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 22/26] libbpf: Let the static linker carry .bpf_cleanup relocations Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 23/26] selftests/bpf: Add end-to-end and negative .bpf_cleanup exception tests Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 24/26] selftests/bpf: Add __set_global() and __ret_global() test tags Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 25/26] selftests/bpf: Cover more accepted .bpf_cleanup exception shapes Yonghong Song
2026-10-15 4:03 ` [PATCH bpf-next v11 26/26] selftests/bpf: Load an exception cleanup program from a light skeleton Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2b3389e9-53c0-4437-b5d3-7a11d60f91b7@linux.dev \
--to=yonghong.song@linux.dev \
--cc=bpf@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox