Re: [PATCH bpf v3 4/7] bpf: Restrict CO-RE poisoning to relocatable instructions

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2026-09-14 at 15:16 +0200, Kumar Kartikeya Dwivedi wrote:
> check_subprogs() verifies that each subprogram ends in an exit or an
> unconditional jump before in-kernel CO-RE relocations are applied.
> An unresolved relocation can then replace that terminal instruction with
> an invalid helper call. The resulting fall-through into another subprogram
> breaks the CFG invariant used by postorder and stack liveness analysis,
> which can write past their per-subprogram arrays.
> 
> Handle instruction poisoning after the instruction has passed the same
> class and operand-form checks used for a resolved relocation. This rejects
> relocations targeting jumps, calls, exits, register-source arithmetic, or
> non-immediate loads before they can alter the control flow. Keep poisoning
> supported instructions, including both halves of a plain ldimm64, so an
> unresolved relocation in dead code remains valid.
> 
> The shared relocation code applies this restriction to both libbpf and
> in-kernel CO-RE.
> 
> Fixes: efcda22aa541 ("bpf: compute instructions postorder per subprogram")
> Reported-by: Nicholas Carlini <npc@anthropic.com>
> Suggested-by: Nicholas Carlini <npc@anthropic.com>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

I think this commit is fine.
The error code is returned and the diagnostics is show if instruction
cannot be patched.