Re: [PATCH bpf-next v10 05/24] bpf: Mark covered call sites and check a program can take a table

[Yonghong Song <yonghong.song@linux.dev>]

On 10/9/26 6:34 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf: exception landing pad target fails to shift under BPF_PATCH_MOVE_TARGET
> --
>
> commit 12354911ea762dbd3bb3462885368e582fd7efd5
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf: Mark covered call sites and check a program can take a table
>
> bpf_exc_prepare() records the landing pad of every call in a cleanup record's
> range. bpf_exc_check_prog() refuses offloaded programs, programs without
> JIT support, and programs with epilogues or exception callbacks.
>
>> diff --git a/kernel/bpf/exception.c b/kernel/bpf/exception.c
>> index 2fef417dc090f..21bc1294227c1 100644
>> --- a/kernel/bpf/exception.c
>> +++ b/kernel/bpf/exception.c
>> @@ -141,6 +141,76 @@ int bpf_exc_check_info(struct bpf_verifier_env *env, const union bpf_attr *attr,
> [ ... ]
>> +static void mark_call_sites(struct bpf_verifier_env *env)
>> +{
>> +	u32 i, j;
>> +
>> +	for (i = 0; i < env->cleanup_info_cnt; i++) {
>> +		struct bpf_cleanup_info *rec = &env->cleanup_info[i];
>> +
>> +		for (j = rec->begin_off; j < rec->end_off; j++) {
>> +			struct bpf_insn *insn = &env->prog->insnsi[j];
>> +
>> +			if (!bpf_pseudo_call(insn) && !bpf_is_callx(insn) &&
>> +			    !bpf_is_unwind_kfunc(insn))
>> +				continue;
>> +			env->insn_aux_data[j].cleanup_pad = rec->landing_pad_off + 1;
> [Severity: High]
> If a landing pad is at the exact start of the program or subprogram
> (landing_pad_off == 0), how does this interact with BPF_PATCH_MOVE_TARGET
> when prepending instructions?
>
> Because kernel/bpf/exception.c:bpf_exc_check_info() permits landing_pad_off
> to be 0 or subprog_start, this structural layout is possible. When it
> happens, the shift logic in kernel/bpf/fixups.c:adjust_insn_aux_data() uses
> a strict greater-than condition:
>
>      if (env->cleanup_info_cnt)
>          for (i = 0; i < prog_len; i++)
>              if (data[i].cleanup_pad > off + 1)
>                  data[i].cleanup_pad += cnt - 1;
>
> If cleanup_pad == off + 1 (e.g., when off=0), it doesn't get shifted.
> But BPF_PATCH_MOVE_TARGET prepends instructions at off=0, such as
> when gen_prologue is called in kernel/bpf/fixups.c:bpf_convert_ctx_accesses().
>
> Will this leave the unwinder jumping into the newly prepended verifier
> instructions rather than the program's original first instruction,
> potentially causing issues like out-of-bounds reads or infinite loops if
> registers are clobbered?

The same as patch 4, BPF_PATCH_MOVE_TARGET is not needed.