[PATCH v5 bpf-next 0/4] bpf: properly verify tail call behavior

Martin Teichmann
2025-11-18T13:45:31Z

Hi List,

sorry for the late response, somehow the continuous integration was down and I
did not want to submit untested code...

This patch set adresses the fact that tail calls may return from the calling
function, which needs to be reflected in the verifier.

The first patch changes the verifier such that it simulates the actual behavior
of a tail call, the second patch tests the correct behavior.

During the discussion of this patch, Eduard Zingerman found another bug in the
stack liveness calculation, and fixed it. This is the third patch, tested by
the fourth. Both patches are written by Eduard, the only thing I changed was to
assure it properly applies on top of my patches, and a small addition that
Eduard asked for. He asked to add his patches on top of mine, yet all credits
for these patches should go to him, I do not intent to steal code here.

Eduard also asked for a test for the register liveness in
compute_live_registers.c. I thought long about it, but unfortunately found no
way to properly test the new behavior, as I could not come up with an example
where it would be different from the original one.

Cheers

Martin

Martin Teichmann (4):
bpf: properly verify tail call behavior
bpf: test the proper verification of tail calls
bpf: correct stack liveness for tail calls
bpf: test the correct stack liveness of tail calls

include/linux/bpf_verifier.h | 5 +-
kernel/bpf/liveness.c | 7 ++-
kernel/bpf/verifier.c | 60 +++++++++++++++++--
.../selftests/bpf/progs/verifier_live_stack.c | 50 ++++++++++++++++
.../selftests/bpf/progs/verifier_sock.c | 39 +++++++++++-
.../bpf/progs/verifier_subprog_precision.c | 47 +++++++++++++++
6 files changed, 196 insertions(+), 12 deletions(-)

--
2.43.0