[PATCH v3 bpf-next 0/2] bpf: properly verify tail call behavior

Martin Teichmann
2025-11-05T17:41:03Z

I added the changes you proposed.

regarding bpf_insn_successors(), nothing needs to be done, call
already have the next instruction as successor by default, and this
is all we need. The fact that a tail call can also be an exit in
disguise is handled by calling bpf_update_live_stack().

In total, this patch now fixed three bugs: a regression wheras
programs that modify packet data after a tail call are unnecessarily
rejected, proper treatment of precision propagation and live stack
tracking.

Martin Teichmann (2):
bpf: properly verify tail call behavior
bpf: test the proper verification of tail calls

kernel/bpf/verifier.c | 26 ++++++++--
.../selftests/bpf/progs/verifier_live_stack.c | 46 ++++++++++++++++++
.../selftests/bpf/progs/verifier_sock.c | 39 ++++++++++++++-
.../bpf/progs/verifier_subprog_precision.c | 47 +++++++++++++++++++
4 files changed, 153 insertions(+), 5 deletions(-)

--
2.43.0