Re: [PATCH bpf-next v1 3/8] bpf: Support for kfuncs with KF_MAGIC_ARGS

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2025-10-29 at 13:49 -0700, Ihor Solodrai wrote:

[...]

> > > +static s32 impl_by_magic_kfunc(s32 func_id)
> > > +{
> > > +	int i;
> > > +
> > > +	for (i = 0; i < BTF_ID_LIST_SIZE(magic_kfuncs); i += 2) {
> > > +		if (magic_kfuncs[i] == func_id)
> > > +			return magic_kfuncs[i + 1];
> >                                     ^^^^^^^^^^^^^^^^^
> > 
> > Can impl_by_magic_kfunc() overflow magic_kfuncs[]? With the current
> > initialization using BTF_ID_UNUSED, BTF_ID_LIST_SIZE(magic_kfuncs)
> > equals 1. The loop condition checks i < 1, so when i=0 it executes and
> > accesses magic_kfuncs[i+1], which is magic_kfuncs[1]. This is outside
> > the array bounds.
> 
> Hmm... Given we do i += 2, this can't happen if magic_kfuncs table is
> defined correctly. Also if BTF_ID_UNUSED is passed in here, we have
> bigger problems.
> 
> I guess changing the loop condition to size-1 wouldn't hurt.

The code is fine and there is no need to bow to the AI overlord.
That time will come, but it hasn't come yet.

[...]