Re: [PATCH bpf-next v5 6/7] bpf: Support per-call-site kfunc specialization

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Mon Sep 28, 2026 at 9:11 PM UTC, bot+bpf-ci wrote:
>> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
>> index 5cbae5d05fe7..7bdbda7764c7 100644
>> --- a/include/linux/bpf_verifier.h
>> +++ b/include/linux/bpf_verifier.h
>
> [ ... ]
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 8183a8f22ed5..8ba831329ab7 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>
> [ ... ]
>
>> @@ -22062,6 +22065,56 @@ static int specialize_kfunc(struct bpf_verifier_env *env, struct bpf_kfunc_desc
>>  	return 0;
>>  }
>>
>> +static int add_kfunc_desc_target(struct bpf_verifier_env *env,
>> +				 const struct bpf_kfunc_desc *target_desc,
>> +				 u16 base_desc_idx, u16 *desc_idx)
>> +{
>> +	struct bpf_kfunc_desc desc = *target_desc;
>> +	struct bpf_kfunc_desc_tab *new_tab;
>> +	struct bpf_kfunc_desc_tab *tab;
>> +	struct bpf_prog_aux *prog_aux;
>> +	u32 i;
>> +
>> +	prog_aux = env->prog->aux;
>> +	tab = prog_aux->kfunc_tab;
>> +
>> +	if (WARN_ON_ONCE(base_desc_idx >= tab->nr_base_descs))
>> +		return -EFAULT;
>> +	if (WARN_ON_ONCE(tab->descs[base_desc_idx].func_id != desc.func_id ||
>> +			 tab->descs[base_desc_idx].offset != desc.offset))
>> +		return -EFAULT;
>
> This isn't a bug, but would verifier_bug_if() be a better fit for these
> sanity checks?
>
> Looking at bpf_fixup_kfunc_call() a few lines below, the
> descriptor-not-found case uses:
>
>   verifier_bug(env, "kernel function descriptor not found for func_id %u",
>                insn->imm);
>   return -EFAULT;
>
> verifier_bug() writes the reason to the verifier log and only WARNs under
> CONFIG_DEBUG_KERNEL. A bare WARN_ON_ONCE() warns on every kernel and leaves
> the log with no explanation for the -EFAULT.
>


Seems like a reasonable change, I will leave this version up for a bit before
resending in case anything else comes up that we need to change in the next
respin. Not applying Changes Requested for now since patches 5/6 could use a
review.


>> +
>> +	if (tab->descs[base_desc_idx].addr == desc.addr) {
>> +		*desc_idx = base_desc_idx;
>> +		return 0;
>> +	}
>> +
>> +	for (i = tab->nr_base_descs; i < tab->nr_descs; i++) {
>> +		if (tab->descs[i].func_id == desc.func_id &&
>> +		    tab->descs[i].offset == desc.offset &&
>> +		    tab->descs[i].addr == desc.addr) {
>> +			*desc_idx = i;
>> +			return 0;
>> +		}
>> +	}
>> +
>> +	if (tab->nr_descs == MAX_KFUNC_CALL_DESCS) {
>> +		verbose(env, "too many different kernel function call targets\n");
>> +		return -E2BIG;
>> +	}
>> +
>> +	new_tab = krealloc(tab, struct_size(tab, descs, tab->nr_descs + 1),
>> +			   GFP_KERNEL_ACCOUNT);
>> +	if (!new_tab)
>> +		return -ENOMEM;
>> +	tab = new_tab;
>> +	prog_aux->kfunc_tab = tab;
>> +
>> +	*desc_idx = tab->nr_descs;
>> +	tab->descs[tab->nr_descs++] = desc;
>> +	return 0;
>> +}
>
> [ ... ]
>
>> @@ -22082,9 +22135,11 @@ static void __fixup_collection_insert_kfunc(struct bpf_insn_aux_data *insn_aux,
>>  int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>>  		     struct bpf_insn *insn_buf, int insn_idx, int *cnt)
>>  {
>> +	struct bpf_kfunc_desc desc_copy;
>>  	struct bpf_kfunc_desc *desc;
>>  	unsigned long call_imm;
>> -	u16 desc_idx;
>> +	u16 base_desc_idx, desc_idx;
>> +	bool near_call;
>>  	int err;
>>
>>  	if (!insn->imm) {
>> @@ -22104,13 +22159,17 @@ int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>>  			     insn->imm);
>>  		return -EFAULT;
>>  	}
>> -	desc_idx = desc - env->prog->aux->kfunc_tab->descs;
>> +	base_desc_idx = desc - env->prog->aux->kfunc_tab->descs;
>> +
>> +	near_call = !bpf_jit_supports_far_kfunc_call();
>> +	desc_copy = *desc;
>> +	desc = &desc_copy;
>>
>>  	err = specialize_kfunc(env, desc, insn_idx);
>>  	if (err)
>>  		return err;
>>
>> -	if (!bpf_jit_supports_far_kfunc_call()) {
>> +	if (near_call) {
>>  		call_imm = BPF_CALL_IMM(desc->addr);
>>  		if ((unsigned long)(s32)call_imm != call_imm) {
>>  			verbose(env, "address of kernel func_id %u is out of range\n",
>
> The same question applies to the WARN_ON_ONCE() in bpf_add_kfunc_call()
> which checks `tab->nr_descs != tab->nr_base_descs`.
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/36480760039