Re: [PATCH bpf-next v10 09/24] bpf: Refuse a landing pad that does not resume

[Yonghong Song <yonghong.song@linux.dev>]

On 10/10/26 5:08 PM, Alexei Starovoitov wrote:
> # CARRIED OVER from the unsent v9 draft (leftover of your v8 09 mail). Delete this line, or the file if you dropped it on purpose.
> On Thu, Oct 08, 2026 at 09:15 PM Yonghong Song <yonghong.song@linux.dev> wrote:
>> +		if (unlikely(env->cleanup_info_cnt)) {
>> +			err = bpf_exc_check_insn(env, insn);
>> +			if (error_recoverable_with_nospec(err) && state->speculative) {
>> +				insn_aux->nospec = true;
>> +				goto process_bpf_exit;
>> +			}
>> +			if (err)
>> +				return err;
>> +		}

Remove the error_recoverable_with_nospec():

+			if (error_recoverable_with_nospec(err) && state->speculative) {
+				insn_aux->nospec = true;
+				goto process_bpf_exit;
+			}

For selftest:

/* A pad whose speculative walk reaches an exit: a barrier, not a refusal. */
static __used __naked __noinline __u64 spec_exit_pad_frame(void)
{
         asm volatile (
         "r1 = %[input] ll;"
         "r6 = *(u64 *)(r1 + 0);"
         "r6 &= 7;"
"1:"    "call always_unwind;"           /* cleanup region */
"2:"
         "r0 = 0;"
         "exit;"
"3:"                                    /* landing pad */
         "if r6 > 7 goto 4f;"            /* never taken: walked speculatively */
         "call bpf_unwind_resume;"
"4:"
         "exit;"
         CLEANUP_REC("1b", "2b", "3b")
         :
         : __imm_addr(input)
         : __clobber_all);
}

SEC("?syscall")
__success __caps_unpriv(CAP_BPF) __success_unpriv
__xlated_unpriv("nospec")
int entry_spec_exit_pad(void *ctx)
{
         return spec_exit_pad_frame();
}

and get the following failure:

libbpf: prog 'entry_spec_exit_pad': BPF program load failed: -EINVAL
libbpf: prog 'entry_spec_exit_pad': failed to load: -EINVAL
libbpf: failed to load object 'exceptions_cleanup_shapes'
run_subtest:FAIL:unexpected_load_failure unexpected error: -22 (errno 22)
VERIFIER LOG:
=============
arg#0 reference type('UNKNOWN ') size cannot be determined: -22
0: R10=fp0
; return spec_exit_pad_frame(); @ exceptions_cleanup_shapes.c:1091
0: (85) call pc+1
caller:
  R10=fp0
callee:
  frame1: R10=fp0
2: frame1: R10=fp0
; asm volatile ( @ exceptions_cleanup_shapes.c:1067
2: (18) r1 = 0x0                      ; frame1: R1=map_value(map=exceptio.bss,ks=4,vs=40)
4: (79) r6 = *(u64 *)(r1 +0)          ; frame1: R1=map_value(map=exceptio.bss,ks=4,vs=40) R6=scalar()
5: (57) r6 &= 7                       ; frame1: R6=scalar(smin=smin32=0,smax=umax=smax32=umax32=7,var_off=(0x0; 0x7))
6: (85) call pc+5
caller:
  frame1: R6=scalar(smin=smin32=0,smax=umax=smax32=umax32=7,var_off=(0x0; 0x7)) R10=fp0
callee:
  frame2: R1=map_value(map=exceptio.bss,ks=4,vs=40) R10=fp0
12: frame2: R1=map_value(map=exceptio.bss,ks=4,vs=40) R10=fp0
; asm volatile ( @ exceptions_cleanup_shapes.c:390
12: (85) call bpf_unwind#87213        ; frame1: R0=scalar()
; asm volatile ( @ exceptions_cleanup_shapes.c:1067
9: (25) if r6 > 0x7 goto pc+1
exit at insn 11 ends a landing pad: a catch pad is not supported yet, only cleanup pads that resume
processed 9 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
=============
#134/56  exceptions_cleanup/entry_spec_exit_pad @unpriv:FAIL


>> +
>>   		if (bpf_is_prune_point(env, env->insn_idx)) {
> since you're going to respin consider the following feedback:
>
> The special case for speculative paths is still here.
> in_pad is compared in func_states_equal() now, so there is no need
> to check before pruning.
> Call bpf_exc_check_insn() from do_check_insn() ?

Moving bpf_exc_check_insn() to do_check_insn() makes sense.
The above selftest succeeded (w.r.t speculative path).

> error_recoverable_with_nospec() after it does the same thing,
> and the error will be printed after the insn instead of before it.