Re: [PATCH bpf-next v4 02/13] bpf: Split subprogram and kfunc collection

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 129e50888b90..24b163c2bd63 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2842,7 +2842,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16 offset)
>  	return 0;
>  }
>
> -static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
> +static int add_subprogs(struct bpf_verifier_env *env)

The rename of add_subprog_and_kfunc() leaves a dangling reference in
kernel/sched/ext/ext.c. The comment in scx_kfunc_filter() still says:

	/*
	 * add_subprog_and_kfunc() collects all kfunc calls, including dead code
	 * guarded by bpf_ksym_exists(), before check_attach_btf_id() sets
	 * prog->aux->st_ops. Allow all kfuncs when st_ops is not yet set;
	 * do_check_main() re-runs the filter with st_ops set and enforces the
	 * actual restrictions.
	 */

Should this be updated to reference add_kfuncs() instead?

>  {
>  	struct bpf_subprog_info *subprog = env->subprog_info;
>  	int i, ret, insn_cnt = env->prog->len, ex_cb_insn;

[ ... ]

> @@ -2905,6 +2900,28 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
>  	return 0;
>  }
>
> +static int add_kfuncs(struct bpf_verifier_env *env)
> +{
> +	struct bpf_insn *insn = env->prog->insnsi;
> +	int i, ret, insn_cnt = env->prog->len;
> +
> +	for (i = 0; i < insn_cnt; i++, insn++) {
> +		if (!bpf_pseudo_kfunc_call(insn))
> +			continue;
> +
> +		if (!env->bpf_capable) {
> +			verbose(env, "loading/calling other bpf or kernel functions are allowed for CAP_BPF and CAP_SYS_ADMIN\n");
> +			return -EPERM;
> +		}
> +
> +		ret = bpf_add_kfunc_call(env, insn->imm, insn->off);
> +		if (ret < 0)
> +			return ret;
> +	}
> +
> +	return 0;
> +}
> +

[ ... ]

> @@ -20322,7 +20339,13 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
>  	if (ret < 0)
>  		goto skip_full_check;
>
> -	ret = add_subprog_and_kfunc(env);
> +	/* Discover all subprograms before validating their layout and BTF. */
> +	ret = add_subprogs(env);
> +	if (ret < 0)
> +		goto skip_full_check;
> +
> +	/* Collect the kfunc descriptors used during verification. */
> +	ret = add_kfuncs(env);
>  	if (ret < 0)
>  		goto skip_full_check;


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31047716344