Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] bpf: state-dependent verification failure for BTF-independent programs --
commit f6fc508c855b2ee6adf6ef6d3d2ccfe35410bcf1 Author: Jay Wang <[email protected]> bpf: fetch the vmlinux BTF where kernel types enter a program This commit delays fetching the vmlinux BTF until kernel types actually enter the verifier state. This prevents unnecessary loading and parsing of BTF for BTF-independent programs like socket filters, saving memory and parsing overhead. > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c [ ... ] > @@ -22532,10 +22580,10 @@ int bpf_check(struct bpf_prog **prog, union > bpf_attr *attr, bpfptr_t uattr, > > mark_verifier_state_clean(env); > > - if (IS_ERR(btf_vmlinux)) { > + if (IS_ERR(bpf_peek_btf_vmlinux())) { [Severity: High] Could this introduce a state-dependent verification failure for BTF-independent programs? When a BTF-independent program (like a systemd socket filter) is loaded initially, the bpf_peek_btf_vmlinux() helper returns a null pointer and this check is bypassed. If a BTF-dependent program is later loaded under memory pressure, the btf_parse_vmlinux() routine could fail with a memory allocation error. When the kernel is configured with BTF enabled, bpf_get_btf_vmlinux() permanently stores this error pointer in the global btf_vmlinux variable. Subsequent loads of completely unrelated, BTF-independent programs will now see the error pointer returned by bpf_peek_btf_vmlinux() evaluate to true and fail with an in-kernel BTF is malformed error in bpf_check(). Will this unintentionally cause transient memory failures during BTF parsing to permanently break unrelated critical system services? > /* Either gcc or pahole or kernel are broken. */ > verbose(env, "in-kernel BTF is malformed\n"); > - ret = PTR_ERR(btf_vmlinux); > + ret = PTR_ERR(bpf_peek_btf_vmlinux()); > goto skip_full_check; > } > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
