Re: [PATCH v4 bpf-next 1/2] bpf: properly verify tail call behavior

Eduard Zingerman
2025-11-10T23:39:56Z

On Mon, 2025-11-10 at 12:28 -0800, Eduard Zingerman wrote:
> On Mon, 2025-11-10 at 16:18 +0100, Martin Teichmann wrote:
>
> [...]
>
> > diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
> > index a7240013fd9d..54f4772d990c 100644
> > --- a/kernel/bpf/liveness.c
> > +++ b/kernel/bpf/liveness.c
> > @@ -500,6 +500,10 @@ bpf_insn_successors(struct bpf_verifier_env *env, u32 idx)
> > if (opcode_info->can_jump)
> > succ->items[succ->cnt++] = idx + bpf_jmp_offset(insn) + 1;
> >
> > + if (unlikely(insn->code == (BPF_JMP | BPF_CALL) && insn->src_reg == 0
> > + && insn->imm == BPF_FUNC_tail_call))
> > + succ->items[succ->cnt++] = idx;
> > +
> > return succ;
> > }
> >
>
> Hi Martin,
>
> This is a clever hack and I like it, but let's not do that.
> It is going to be a footgun if e.g. someone would use
> bpf_insn_successors() to build intra-procedural CFG.
> Instead, please allocate a jt object for tail calls as in the diff
> attached (on top of your patch-set). Please also extend
> compute_live_registers.c to cover this logic.

clear_insn_aux_data() will also need an update to avoid leaking
env->insn_aux_data[...].jt for tail calls...

> Other than that, I think that patch logic and tests are fine.
>
> Thanks,
> Eduard
>
> …