Re: [PATCH bpf-next v10 05/24] bpf: Mark covered call sites and check a program can take a table

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: exception landing pad target fails to shift under BPF_PATCH_MOVE_TARGET
--

commit 12354911ea762dbd3bb3462885368e582fd7efd5
Author: Yonghong Song <yonghong.song@linux.dev>

bpf: Mark covered call sites and check a program can take a table

bpf_exc_prepare() records the landing pad of every call in a cleanup record's
range. bpf_exc_check_prog() refuses offloaded programs, programs without
JIT support, and programs with epilogues or exception callbacks.

> diff --git a/kernel/bpf/exception.c b/kernel/bpf/exception.c
> index 2fef417dc090f..21bc1294227c1 100644
> --- a/kernel/bpf/exception.c
> +++ b/kernel/bpf/exception.c
> @@ -141,6 +141,76 @@ int bpf_exc_check_info(struct bpf_verifier_env *env, const union bpf_attr *attr,
[ ... ]
> +static void mark_call_sites(struct bpf_verifier_env *env)
> +{
> +	u32 i, j;
> +
> +	for (i = 0; i < env->cleanup_info_cnt; i++) {
> +		struct bpf_cleanup_info *rec = &env->cleanup_info[i];
> +
> +		for (j = rec->begin_off; j < rec->end_off; j++) {
> +			struct bpf_insn *insn = &env->prog->insnsi[j];
> +
> +			if (!bpf_pseudo_call(insn) && !bpf_is_callx(insn) &&
> +			    !bpf_is_unwind_kfunc(insn))
> +				continue;
> +			env->insn_aux_data[j].cleanup_pad = rec->landing_pad_off + 1;

[Severity: High]
If a landing pad is at the exact start of the program or subprogram
(landing_pad_off == 0), how does this interact with BPF_PATCH_MOVE_TARGET
when prepending instructions?

Because kernel/bpf/exception.c:bpf_exc_check_info() permits landing_pad_off
to be 0 or subprog_start, this structural layout is possible. When it
happens, the shift logic in kernel/bpf/fixups.c:adjust_insn_aux_data() uses
a strict greater-than condition:

    if (env->cleanup_info_cnt)
        for (i = 0; i < prog_len; i++)
            if (data[i].cleanup_pad > off + 1)
                data[i].cleanup_pad += cnt - 1;

If cleanup_pad == off + 1 (e.g., when off=0), it doesn't get shifted.
But BPF_PATCH_MOVE_TARGET prepends instructions at off=0, such as
when gen_prologue is called in kernel/bpf/fixups.c:bpf_convert_ctx_accesses().

Will this leave the unwinder jumping into the newly prepended verifier
instructions rather than the program's original first instruction,
potentially causing issues like out-of-bounds reads or infinite loops if
registers are clobbered?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009041447.17092-1-yonghong.song@linux.dev?part=5