Re: [PATCH v2 bpf-next 1/5] bpf: Add unwind_goto and unwind_exit insns

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: build failure in bpf_unwind_target() on MIPS due to missing fixup field
--

commit c2ccff0580e3d9f39dd46bc86407477749d28180
Author: Alexei Starovoitov <ast@kernel.org>

bpf: Add unwind_goto and unwind_exit insns

This patch introduces unwind_goto and unwind_exit BPF instructions to
support frame unwinding for Rust Drop, C++ destructors, and C cleanup
attributes. The verifier validates landing pads and unwind paths, while
JITs use exception table entries and bpf_unwind_target() to redirect return
addresses on unwind_exit.

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 6e32db9777c2a..da3691b47cc72 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -804,6 +804,24 @@ const struct exception_table_entry *search_bpf_extables(unsigned long addr)
>  	return e;
>  }
>  
> +/*
> + * JITs don't emit a branch for unwind_goto. They add an extable entry
> + *   { .insn = ret_addr - 1, .fixup = pad - ret_addr }
> + * where ret_addr is the return address of the call in front of it. unwind_exit
> + * replaces the return address of its frame with what this function returns.
> + * ret_addr - 1, because what follows the call can have an entry of its own.
> + * No insn starts there, so a fault cannot hit the entry.
> + */
> +u64 bpf_unwind_target(u64 ret_addr)
> +{
> +	const struct exception_table_entry *e = search_bpf_extables(ret_addr - 1);
> +
> +	/* The verifier made sure that unwind_goto follows the call */
> +	if (WARN_ON_ONCE(!e))
> +		return ret_addr;
> +	return ret_addr + e->fixup;
> +}

[Severity: Low]
Does bpf_unwind_target() cause a build regression on MIPS when
CONFIG_BPF_JIT is enabled?

In kernel/bpf/core.c, bpf_unwind_target() is compiled whenever
CONFIG_BPF_JIT is enabled and accesses e->fixup directly.

MIPS selects HAVE_EBPF_JIT (when !CPU_MICROMIPS in arch/mips/Kconfig),
allowing CONFIG_BPF_JIT to be enabled, but arch/mips/include/asm/extable.h
defines struct exception_table_entry with nextinsn instead of fixup:

struct exception_table_entry
{
	unsigned long insn;
	unsigned long nextinsn;
};

None of the subsequent patches in the series guard bpf_unwind_target() or
provide an architecture-specific accessor for this field.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019051846.3012089-1-alexei.starovoitov@gmail.com?part=1