Re: [PATCH v2 2/2] x86/cfi,bpf: Fix BPF JIT call

Peter Zijlstra
2023-12-08T17:22:06Z

On Fri, Dec 08, 2023 at 02:40:41PM +0100, Peter Zijlstra wrote:
> On Fri, Dec 08, 2023 at 11:29:40AM +0100, Peter Zijlstra wrote:
> > The only problem I now have is the one XXX, I'm not entirely sure what
> > signature to use there.
>
> > @@ -119,6 +119,7 @@ int bpf_struct_ops_test_run(struct bpf_p
> > op_idx = prog->expected_attach_type;
> > err = bpf_struct_ops_prepare_trampoline(tlinks, link,
> > &st_ops->func_models[op_idx],
> > + /* XXX */ NULL,
> > image, image + PAGE_SIZE);
> > if (err < 0)
> > goto out;
>
> Duh, that should ofcourse be something of dummy_ops_test_ret_fn type.
> Let me go fix that.

Next one.. bpf_obj_free_fields: field->kptr.dtor(xchg_field);

The one that trips is bpf_cgroup_release().

objtool doesn't think the address of that function 'escapes' and
'helpfully' seals that function, and then BPF thinks it does escape and
manages the above indirect call and *boom*.

How can I tell which functions escape according to BPF such that I might
teach objtool this?