Re: [PATCH bpf-next v1 3/8] bpf: Support for kfuncs with KF_MAGIC_ARGS

bot+bpf-ci
2025-10-29T19:41:20Z

[-- Attachment #1: Type: text/plain, Size: 2078 bytes --]

```
commit 974828216758f5fff2d9783439b8daa20188ce8c
Author: Ihor Solodrai <ihor.solodrai@linux.dev>

bpf: Support for kfuncs with KF_MAGIC_ARGS

This patch adds infrastructure for magic kfuncs, which have two BTF
representations: one for BPF programs and one for kernel implementation.
The verifier resolves these through a lookup table.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index cb1b483be..fcf0872b9 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -3263,17 +3263,68 @@ static struct btf *find_kfunc_desc_btf(struct bpf_verifier_env *env, s16 offset)
> return btf_vmlinux ?: ERR_PTR(-ENOENT);
> }
>
> +/*
> + * magic_kfuncs is used as a list of (foo, foo_impl) pairs
> + */
> +BTF_ID_LIST(magic_kfuncs)
> +BTF_ID_UNUSED
> +BTF_ID_LIST_END(magic_kfuncs)
> +
> +static s32 magic_kfunc_by_impl(s32 impl_func_id)
> +{
> + int i;
> +
> + for (i = 1; i < BTF_ID_LIST_SIZE(magic_kfuncs); i += 2) {
> + if (magic_kfuncs[i] == impl_func_id)
> + return magic_kfuncs[i - 1];
> + }
> + return -ENOENT;
> +}
> +
> +static s32 impl_by_magic_kfunc(s32 func_id)
> +{
> + int i;
> +
> + for (i = 0; i < BTF_ID_LIST_SIZE(magic_kfuncs); i += 2) {
> + if (magic_kfuncs[i] == func_id)
> + return magic_kfuncs[i + 1];
^^^^^^^^^^^^^^^^^

Can impl_by_magic_kfunc() overflow magic_kfuncs[]? With the current
initialization using BTF_ID_UNUSED, BTF_ID_LIST_SIZE(magic_kfuncs)
equals 1. The loop condition checks i < 1, so when i=0 it executes and
accesses magic_kfuncs[i+1], which is magic_kfuncs[1]. This is outside
the array bounds.

The same issue applies generally: the loop checks i < size but accesses
i+1, so it should check i+1 < size instead.

> + }
> + return -ENOENT;
> +}

[ ... ]

```

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

In-Reply-To-Subject: `bpf: Support for kfuncs with KF_MAGIC_ARGS`
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/18919699520