Re: [PATCH v2 2/2] x86/cfi,bpf: Fix BPF JIT call

Alexei Starovoitov
2023-12-08T19:40:52Z

On Fri, Dec 8, 2023 at 9:22 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> On Fri, Dec 08, 2023 at 02:40:41PM +0100, Peter Zijlstra wrote:
> > On Fri, Dec 08, 2023 at 11:29:40AM +0100, Peter Zijlstra wrote:
> > > The only problem I now have is the one XXX, I'm not entirely sure what
> > > signature to use there.
> >
> > > @@ -119,6 +119,7 @@ int bpf_struct_ops_test_run(struct bpf_p
> > > op_idx = prog->expected_attach_type;
> > > err = bpf_struct_ops_prepare_trampoline(tlinks, link,
> > > &st_ops->func_models[op_idx],
> > > + /* XXX */ NULL,
> > > image, image + PAGE_SIZE);
> > > if (err < 0)
> > > goto out;
> >
> > Duh, that should ofcourse be something of dummy_ops_test_ret_fn type.
> > Let me go fix that.
>
> Next one.. bpf_obj_free_fields: field->kptr.dtor(xchg_field);
>
> The one that trips is bpf_cgroup_release().
>
> objtool doesn't think the address of that function 'escapes' and
> 'helpfully' seals that function, and then BPF thinks it does escape and
> manages the above indirect call and *boom*.
>
> How can I tell which functions escape according to BPF such that I might
> teach objtool this?

I'm not following.
Are you asking to annotate
__bpf_kfunc void bpf_cgroup_release(struct cgroup *cgrp)
somehow so that objtool knows that it will be called indirectly?
typedef void (*btf_dtor_kfunc_t)(void *);
btf_dtor_kfunc_t dtor;
but the bpf_cgroup_release takes 'struct cgroup*'.
From kcfi pov void * == struct cgroup * ?
Do we need to change it to 'void *cgrp' ?
What is "sealing" by objtool?