Re: [PATCH bpf-next v2 05/20] bpf: Make exception landing pads reachable in the CFG

[Yonghong Song <yonghong.song@linux.dev>]

On 9/17/26 9:59 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf: missing prune point at exception landing pad target
> --
>
> commit 4fbd0e36862ba7e3ee8480e535068a6821d5cad0
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf: Make exception landing pads reachable in the CFG
>
> This commit updates the verifier's control flow graph and liveness analysis
> to properly handle exception landing pads. It ensures that exception throwing
> calls can reach cleanup records, and prevents outer frame stack slots from
> being read incorrectly when control is transferred to landing pads.
>
>> diff --git a/kernel/bpf/cfg.c b/kernel/bpf/cfg.c
>> index 842c7d1eabccc..9f8b8b54d5ea7 100644
>> --- a/kernel/bpf/cfg.c
>> +++ b/kernel/bpf/cfg.c
> [ ... ]
>
>> @@ -158,17 +159,57 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env)
>>   	return DONE_EXPLORING;
>>   }
>>   
>> +static int visit_cleanup_pad_edge(int t, struct bpf_verifier_env *env)
>> +{
>> +	int *insn_stack = env->cfg.insn_stack;
>> +	int *insn_state = env->cfg.insn_state;
>> +	int w;
>> +
>> +	if (!env->cleanup_info_cnt)
>> +		return DONE_EXPLORING;
>> +	w = bpf_cleanup_pad_of_call(env, t);
>> +	if (w < 0)
>> +		return DONE_EXPLORING;
>> +
>> +	mark_prune_point(env, t);
>> +	mark_jmp_point(env, w);
>> +	mark_jump_target(env, w);
> [Severity: High]
> Should mark_prune_point() be applied to the landing pad target w instead of
> the call site t?
>
> Because w is a branch target where control flow merges, it needs to be marked
> as a prune point so the verifier knows to check for state convergence. By
> marking t instead of w, the verifier will evaluate the landing pad and all
> subsequent cleanup instructions independently for every exception-throwing
> call that branches to w.
>
> Can this lead to combinatorial path explosion and result in the verifier
> rejecting the program with -E2BIG?

We can add mark_prune_point(env, w) as well, esp. there are cases there
are multiple cleanup regions but many (or all) of them may pointing into
the same landing pad.

>
> [ ... ]
>