]> git.ipfire.org Git - thirdparty/linux.git/commit
bpf: verifier: Move desc->imm setup to sort_kfunc_descs_by_imm_off()
authorPuranjay Mohan <puranjay@kernel.org>
Fri, 14 Nov 2025 15:40:22 +0000 (15:40 +0000)
committerAlexei Starovoitov <ast@kernel.org>
Sat, 15 Nov 2025 01:55:18 +0000 (17:55 -0800)
commit4f7bc83b983743b439e36b4d30883a87b371cba3
treeae8cd46a82b68c182add3643e61471afba8fbeca
parenta4d31f451d5be2a65cfe8459808948071e9b54a0
bpf: verifier: Move desc->imm setup to sort_kfunc_descs_by_imm_off()

Metadata about a kfunc call is added to the kfunc_tab in
add_kfunc_call() but the call instruction itself could get removed by
opt_remove_dead_code() later if it is not reachable.

If the call instruction is removed, specialize_kfunc() is never called
for it and the desc->imm in the kfunc_tab is never initialized for this
kfunc call. In this case, sort_kfunc_descs_by_imm_off(env->prog); in
do_misc_fixups() doesn't sort the table correctly.
This is a problem for s390 as its JIT uses this table to find the
addresses for kfuncs, and if this table is not sorted properly, JIT may
fail to find addresses for valid kfunc calls.

This was exposed by:

commit d869d56ca848 ("bpf: verifier: refactor kfunc specialization")

as before this commit, desc->imm was initialised in add_kfunc_call()
which happens before dead code elimination.

Move desc->imm setup down to sort_kfunc_descs_by_imm_off(), this fixes
the problem and also saves us from having the same logic in
add_kfunc_call() and specialize_kfunc().

Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251114154023.12801-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c