Re: [PATCH 6.6.y/6.12.y/6.18.y 1/2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs

[Pu Lehui <pulehui@huawei.com>]

On 2026/7/22 15:39, Philo Lu wrote:
> From: Daniel Borkmann <daniel@iogearbox.net>
> 
> commit ee861486e377edc55361c08dcbceab3f6b6577bd upstream.
> 
> Usage of ld_{abs,ind} instructions got extended into subprogs some time
> ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These
> are only allowed in subprograms when the latter are BTF annotated and
> have scalar return types.
> 
> The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +
> exit) from legacy cBPF times. While the enforcement is on scalar return
> types, the verifier must also simulate the path of abnormal exit if the
> packet data load via ld_{abs,ind} failed.
> 
> This is currently not the case. Fix it by having the verifier simulate
> both success and failure paths, and extend it in similar ways as we do
> for tail calls. The success path (r0=unknown, continue to next insn) is
> pushed onto stack for later validation and the r0=0 and return to the
> caller is done on the fall-through side.
> 
> Fixes: 09b28d76eac4 ("bpf: Add abnormal return checks.")
> Reported-by: STAR Labs SG <info@starlabs.sg>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Link: https://lore.kernel.org/r/20260408191242.526279-2-daniel@iogearbox.net
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> [ Dropped visit_abnormal_return_insn changes: depends on 7.0 symbols from
>   e40f5a6bf88a ("bpf: correct stack liveness for tail calls");
>   Hunk1: adapted IS_ERR/PTR_ERR to !branch/-EFAULT to match push_stack()
>   NULL-on-failure convention. ]

These versions does not introduce consumers corresponding to the output
of jump tables; therefore, the assignment of jump tables is not involved.

Reviewed-by: Pu Lehui <pulehui@huawei.com>

> Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
> ---
>   kernel/bpf/verifier.c | 17 +++++++++++++++++
>   1 file changed, 17 insertions(+)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index f638b2d3a42fb..3f74767e47484 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -15119,6 +15119,23 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
>   	mark_reg_unknown(env, regs, BPF_REG_0);
>   	/* ld_abs load up to 32-bit skb data. */
>   	regs[BPF_REG_0].subreg_def = env->insn_idx + 1;
> +	/*
> +	 * See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0
> +	 * which must be explored by the verifier when in a subprog.
> +	 */
> +	if (env->cur_state->curframe) {
> +		struct bpf_verifier_state *branch;
> +
> +		mark_reg_scratched(env, BPF_REG_0);
> +		branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
> +		if (!branch)
> +			return -EFAULT;
> +		mark_reg_known_zero(env, regs, BPF_REG_0);
> +		err = prepare_func_exit(env, &env->insn_idx);
> +		if (err)
> +			return err;
> +		env->insn_idx--;
> +	}
>   	return 0;
>   }
> 
> --
> 2.47.3
> 
>