Re: [PATCH v3 bpf-next 14/18] bpf: Require the JIT for fmod_ret programs on found 64-bit targets

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] bpf: missing jit_required in fmodret_retval_init() for 32-bit
  int on ppc64
--

commit be8ba9e6d31af4b7ee8b1ec3bc7241dc8e6ff517
Author: Anton Protopopov <a.s.protopopov@gmail.com>

bpf: Require the JIT for fmod_ret programs on found 64-bit targets

This commit sets jit_required for fmod_ret programs attached to found
targets with 8-byte return types so the BPF interpreter does not truncate
64-bit return values to 32 bits.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b12b57c7403e4..920ff39aac429 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -23883,6 +23883,9 @@ static int fmodret_retval_init(struct bpf_verifier_env *env, u32 btf_id,
>  
>  	aux->fmodret_retvals = retvals;
>  	aux->fmodret_retval_cnt = cnt;
> +	/* The interpreter returns only 32 bits */
> +	if (size == 8)
> +		env->prog->jit_required = 1;

[Severity: Medium]
Does fmodret_retval_init() also need to set jit_required when size == 4?

On 64-bit PowerPC (which supports BPF trampolines without selecting
ARCH_WANT_BPF_JIT_ALWAYS_ON), the ELF ABI requires a callee returning a
32-bit signed int to sign-extend r3 to 64 bits, and callers inspect all 64
bits of r3.  DEFINE_BPF_PROG_RUN() defines the interpreter entry points as
returning unsigned int, which zero-extends r3 to 64 bits.

In arch/powerpc/net/bpf_jit_comp.c, invoke_bpf_prog() and
__arch_prepare_bpf_trampoline() save and restore all 64 bits of r3 without
sign-extending 32-bit return values, so when the interpreter runs an
fmod_ret program on a target returning int, a negative error return value
is zero-extended to a positive 64-bit value in r3 while skipping the
target function.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110164046.454431-1-a.s.protopopov@gmail.com?part=14