Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[Leon Hwang <leon.hwang@linux.dev>]

On 3/7/26 10:57, Tiezhu Yang wrote:
> On 2026/7/2 下午10:58, sashiko-bot@kernel.org wrote:
[...]
>>> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
>>> index 649cce41e13f3..5fcd19ccb41a9 100644
>>> --- a/kernel/bpf/core.c
>>> +++ b/kernel/bpf/core.c
>>> @@ -2619,8 +2619,7 @@ struct bpf_prog
>>> *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
>>>       if (fp->bpf_func)
>>>           goto finalize;
>>>   -    if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
>>> -        bpf_prog_has_kfunc_call(fp))
>>> +    if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) || fp->jit_required)
>>>           jit_needed = true;
>>>         if (!bpf_prog_select_interpreter(fp))
>>
>> [Severity: Medium]
>> Since bpf_prog_has_kfunc_call() was replaced here with fp->jit_required,
>> should bpf_fixup_call_args() in kernel/bpf/fixups.c also be updated to
>> use
>> the new flag?
>>
>> Currently, bpf_fixup_call_args() still calls
>> bpf_prog_has_kfunc_call(). If
>> a program has a pruned kfunc (allocating kfunc_tab but leaving
>> jit_required=0) and JIT falls back to the interpreter, wouldn't
>> bpf_fixup_call_args() incorrectly reject the program with -EINVAL?


I think this rejection is intentional. '!!prog->aux->kfunc_tab' means
there is kfunc call in the prog, even though the kfunc call could be pruned.

>>
>> kernel/bpf/fixups.c:bpf_fixup_call_args() {
>>      ...
>>     bool has_kfunc_call = bpf_prog_has_kfunc_call(prog);
>>      ...
>>     if (has_kfunc_call) {
>>         verbose(env, "calling kernel functions are not allowed in non-
>> JITed programs\n");
>>         return -EINVAL;
>>     }
>>      ...
>> }

[...]

> ```
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index f496b45b9da4..1f5824c1c691 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2772,7 +2772,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env
> *env, u32 func_id, u16 offset)
> 
>  bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
>  {
> -       return !!prog->aux->kfunc_tab;
> +       return prog->jit_required && !!prog->aux->kfunc_tab;


When 'prog->jit_required' is used for JIT-inlineable helper call, this
change could also cause false positive for the above pruned kfunc case.

If you don't want bpf_fixup_call_args() rejects the program with -EINVAL
for the pruned kfunc case, suggest moving 'if (!func_id && !offset)'
before the tab allocation in bpf_add_kfunc_call().

Thanks,
Leon

>  }
> [...]