Re: [PATCH bpf-next v1 3/8] bpf: Support for kfuncs with KF_MAGIC_ARGS

Ihor Solodrai
2025-10-29T20:49:16Z

On 10/29/25 12:41 PM, bot+bpf-ci@kernel.org wrote:
>
> ```
> commit 974828216758f5fff2d9783439b8daa20188ce8c
> Author: Ihor Solodrai <ihor.solodrai@linux.dev>
>
> bpf: Support for kfuncs with KF_MAGIC_ARGS
>
> This patch adds infrastructure for magic kfuncs, which have two BTF
> representations: one for BPF programs and one for kernel implementation.
> The verifier resolves these through a lookup table.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index cb1b483be..fcf0872b9 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -3263,17 +3263,68 @@ static struct btf *find_kfunc_desc_btf(struct bpf_verifier_env *env, s16 offset)
>> return btf_vmlinux ?: ERR_PTR(-ENOENT);
>> }
>>
>> +/*
>> + * magic_kfuncs is used as a list of (foo, foo_impl) pairs
>> + */
>> +BTF_ID_LIST(magic_kfuncs)
>> +BTF_ID_UNUSED
>> +BTF_ID_LIST_END(magic_kfuncs)
>> +
>> +static s32 magic_kfunc_by_impl(s32 impl_func_id)
>> +{
>> + int i;
>> +
>> + for (i = 1; i < BTF_ID_LIST_SIZE(magic_kfuncs); i += 2) {
>> + if (magic_kfuncs[i] == impl_func_id)
>> + return magic_kfuncs[i - 1];
>> + }
>> + return -ENOENT;
>> +}
>> +
>> +static s32 impl_by_magic_kfunc(s32 func_id)
>> +{
>> + int i;
>> +
>> + for (i = 0; i < BTF_ID_LIST_SIZE(magic_kfuncs); i += 2) {
>> + if (magic_kfuncs[i] == func_id)
>> + return magic_kfuncs[i + 1];
> ^^^^^^^^^^^^^^^^^
>
> Can impl_by_magic_kfunc() overflow magic_kfuncs[]? With the current
> initialization using BTF_ID_UNUSED, BTF_ID_LIST_SIZE(magic_kfuncs)
> equals 1. The loop condition checks i < 1, so when i=0 it executes and
> accesses magic_kfuncs[i+1], which is magic_kfuncs[1]. This is outside
> the array bounds.

Hmm... Given we do i += 2, this can't happen if magic_kfuncs table is
defined correctly. Also if BTF_ID_UNUSED is passed in here, we have
bigger problems.

I guess changing the loop condition to size-1 wouldn't hurt.

>
> The same issue applies generally: the loop checks i < size but accesses
> i+1, so it should check i+1 < size instead.
>
>> + }
>> + return -ENOENT;
>> +}
>
> [ ... ]
>
>
> ```
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> In-Reply-To-Subject: `bpf: Support for kfuncs with KF_MAGIC_ARGS`
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/18919699520