[PATCH v6 bpf-next 0/4] bpf: properly verify tail call behavior

Martin Teichmann
2025-11-19T16:04:05Z

Hi Eduard, Hi Alexei, Hi List,

thanks for the good feedback.

Some details:

Eduard wrote:

> > + env->insn_idx--;
>
> This insn_idx adjustment is a bit unfortunate, but refactoring getting
> rid of it is probably out of scope for this series.

Indeed. I tried hard to avoid it but couldn't find a way that would not have
let this patch explode. Similarly, check_helper_call by now ends with a lot
of if's checking func_id. This should at some point probably be replaced by
a switch statement.

Eduard also wrote:

> > +__msg("mark_precise: frame0: parent state regs=r0 stack=: R0=Pscalar() R6=map_value(map=.data.vals,ks=4,vs=16) R10=fp0")
>
> Nit: I'd add a couple more lines to this __msg sequence to check that
> backtrack_insn correctly moved one frame down.

I added some more __msg lines where it enters the subprogram, that's where the
patch changes behavior.

Cheers

Martin

Eduard Zingerman (2):
bpf: correct stack liveness for tail calls
bpf: test the correct stack liveness of tail calls

Martin Teichmann (2):
bpf: properly verify tail call behavior
bpf: test the proper verification of tail calls

include/linux/bpf_verifier.h | 5 +-
kernel/bpf/liveness.c | 7 ++-
kernel/bpf/verifier.c | 60 +++++++++++++++++--
.../selftests/bpf/progs/verifier_live_stack.c | 50 ++++++++++++++++
.../selftests/bpf/progs/verifier_sock.c | 39 +++++++++++-
.../bpf/progs/verifier_subprog_precision.c | 53 ++++++++++++++++
6 files changed, 202 insertions(+), 12 deletions(-)

--
2.43.0