From: Yonghong Song <yonghong.song@linux.dev>
To: Sami Tolvanen <samitolvanen@google.com>
Cc: bpf@vger.kernel.org, Vadim Fedorenko <vadim.fedorenko@linux.dev>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Martin KaFai Lau <martin.lau@linux.dev>,
Eduard Zingerman <eddyz87@gmail.com>, Song Liu <song@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
KP Singh <kpsingh@kernel.org>,
Stanislav Fomichev <sdf@fomichev.me>, Hao Luo <haoluo@google.com>,
Jiri Olsa <jolsa@kernel.org>, Jamal Hadi Salim <jhs@mojatatu.com>,
Cong Wang <xiyou.wangcong@gmail.com>,
Jiri Pirko <jiri@resnulli.us>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH bpf-next 0/4] Use correct destructor kfunc types
Date: Fri, 25 Jul 2025 09:54:25 -0700 [thread overview]
Message-ID: <f82341df-bf2a-4913-a58c-e0acdfb245d2@linux.dev> (raw)
In-Reply-To: <CABCJKud8u_AF6=gWvvYqMeP71kWG3k88jjozEBmXpW9r4YxGKQ@mail.gmail.com>
On 7/25/25 9:22 AM, Sami Tolvanen wrote:
> Hi,
>
> On Fri, Jul 25, 2025 at 9:05 AM Yonghong Song <yonghong.song@linux.dev> wrote:
>> I tried your patch set on top of latest bpf-next. The problem
>> still exists with the following error:
>>
>> [ 71.976265] CFI failure at bpf_obj_free_fields+0x298/0x620 (target: __bpf_crypto_ctx_release+0x0/0x10; expected type: 0xc1113566)
>> [ 71.980134] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
>> ...
>>
>>
>> The following is the CFI related config items:
>>
>> $ grep CFI .config
>> CONFIG_CFI_AUTO_DEFAULT=y
>> CONFIG_FUNCTION_PADDING_CFI=11
>> CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
>> CONFIG_ARCH_USES_CFI_TRAPS=y
>> CONFIG_CFI_CLANG=y
>> # CONFIG_CFI_ICALL_NORMALIZE_INTEGERS is not set
>> CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y
>> CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC=y
>> # CONFIG_CFI_PERMISSIVE is not set
>>
>> Did I miss anything?
> Interesting. I tested this on arm64 and confirmed that the issue is
> fixed there, so I wonder if we need to use KCFI_REFERENCE() here to
> make sure objtool / x86 runtime patching knows this function actually
> indirectly called. I'll test this on x86 and see what's going on.
I just tried arm64 with your patch set. CFI crash still happened:
CFI failure at tcp_ack+0xe74/0x13cc (target: bpf__tcp_congestion_ops_in_ack_event+0x0/0x78; expected type: 0x64424
87a)
Internal error: Oops - CFI: 00000000f2008228 [#1] SMP
Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)]
CPU: 0 UID: 0 PID: 152 Comm: test_progs Tainted: G OE 6.16.0-rc6-g95993dc3039e-dirty #162 NONE
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: linux,dummy-virt (DT)
pstate: 33400005 (nzCV daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : tcp_ack+0xe74/0x13cc
lr : tcp_ack+0xe34/0x13cc
The arm64 CFI related config:
$ cat .config | grep CFI
CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y
CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
CONFIG_CFI_CLANG=y
# CONFIG_CFI_ICALL_NORMALIZE_INTEGERS is not set
CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y
# CONFIG_CFI_PERMISSIVE is not set
>
> Thanks for taking a look!
>
> Sami
next prev parent reply other threads:[~2025-07-25 16:54 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-24 22:32 [PATCH bpf-next 0/4] Use correct destructor kfunc types Sami Tolvanen
2025-07-24 22:32 ` [PATCH bpf-next 1/4] bpf: crypto: Use the correct destructor kfunc type Sami Tolvanen
2025-07-25 16:13 ` Yonghong Song
2025-07-24 22:32 ` [PATCH bpf-next 2/4] bpf: net_sched: " Sami Tolvanen
2025-07-24 22:32 ` [PATCH bpf-next 3/4] selftests/bpf: " Sami Tolvanen
2025-07-24 22:32 ` [PATCH bpf-next 4/4] bpf, btf: Enforce destructor kfunc type with CFI Sami Tolvanen
2025-07-25 16:05 ` [PATCH bpf-next 0/4] Use correct destructor kfunc types Yonghong Song
2025-07-25 16:22 ` Sami Tolvanen
2025-07-25 16:54 ` Yonghong Song [this message]
2025-07-25 17:20 ` Sami Tolvanen
2025-07-25 17:48 ` Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f82341df-bf2a-4913-a58c-e0acdfb245d2@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=samitolvanen@google.com \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=vadim.fedorenko@linux.dev \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).