Re: [PATCH bpf-next v4 13/13] bpf: Reject tracing progs for struct_ops with arena args

> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 00aaa23b4f7e..68ff66787ae1 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -2367,6 +2367,7 @@ static inline int bpf_fsession_cookie_cnt(struct bpf_tramp_nodes *nodes)
>
>  int bpf_prog_ctx_arg_info_init(struct bpf_prog *prog,
>  			       const struct bpf_ctx_arg_aux *info, u32 cnt);
> +bool bpf_prog_has_arena_ctx_arg(const struct bpf_prog *prog);
>
>  #if defined(CONFIG_CGROUP_BPF) && defined(CONFIG_BPF_LSM)
>  int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog,
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index b349e0817184..e07af35ed040 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -529,16 +529,6 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total, bool *ip_a
>  	return tnodes;
>  }
>
> -static bool bpf_prog_has_arena_ctx_arg(const struct bpf_prog *prog)
> -{
> -	int i;
> -
> -	for (i = 0; i < prog->aux->ctx_arg_info_size; i++)
> -		if (base_type(prog->aux->ctx_arg_info[i].reg_type) == PTR_TO_ARENA)
> -			return true;
> -	return false;
> -}
> -

Moving bpf_prog_has_arena_ctx_arg() from kernel/bpf/trampoline.c (where it
was static) to kernel/bpf/verifier.c creates a link-time undefined symbol
with CONFIG_BPF_JIT=y and CONFIG_BPF_SYSCALL=n?

The two objects have different Kconfig gates in kernel/bpf/Makefile:

  obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o ...
  obj-$(CONFIG_BPF_JIT) += trampoline.o

So trampoline.o can be built without verifier.o. But the trampoline still
calls bpf_prog_has_arena_ctx_arg() here:

kernel/bpf/trampoline.c:__bpf_trampoline_link_prog() {
    kind = bpf_attach_type_to_tramp(node->link->prog);
    /*
     * Arena ctx args are converted only by struct_ops indirect
     * trampolines. They must never be attached to a generic trampoline.
     */
    if (WARN_ON_ONCE(bpf_prog_has_arena_ctx_arg(node->link->prog)))
        return -ENOTSUPP;

The call is not guarded by any conditional. The function that contains it
is also non-static and exported (bpf_trampoline_link_prog() calls it from
outside any Kconfig guard).

The new prototype in include/linux/bpf.h sits outside every Kconfig block
as well (just under the _LINUX_BPF_H include guard), and there is no stub
for the !CONFIG_BPF_SYSCALL case.

arch/powerpc/configs/mpc885_ads_defconfig sets CONFIG_BPF_JIT=y and
CONFIG_NET=y (which selects BPF) but never sets CONFIG_BPF_SYSCALL, and
nothing it enables selects BPF_SYSCALL either. CONFIG_BPF_JIT only depends
on BPF and HAVE_CBPF_JIT || HAVE_EBPF_JIT; PPC selects HAVE_EBPF_JIT
unconditionally so that config is reachable.

Other cross-object calls from trampoline.c follow one of two patterns. The
other verifier.c symbol, bpf_check_attach_btf_id_multi(), is called only
inside a block that explicitly includes defined(CONFIG_BPF_SYSCALL). And
bpf_prog_inc_misses_counter(), a syscall.c symbol, is declared inside
ifdef CONFIG_BPF_SYSCALL with a static inline stub in the else.

Would it work to either add the same stub pattern for
bpf_prog_has_arena_ctx_arg() in the header, or keep it static in
trampoline.c and give verifier.c its own copy?

>  /*
>   * The arena base against which save_args() converts the arguments marked
>   * with BTF_FMODEL_ARENA_ARG. Only the struct_ops indirect trampoline

[ ... ]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 6897b08dd010..60d1ea9a094a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -18868,6 +18868,16 @@ int bpf_prog_ctx_arg_info_init(struct bpf_prog *prog,
>  	return prog->aux->ctx_arg_info ? 0 : -ENOMEM;
>  }
>
> +bool bpf_prog_has_arena_ctx_arg(const struct bpf_prog *prog)
> +{
> +	int i;
> +
> +	for (i = 0; i < prog->aux->ctx_arg_info_size; i++)
> +		if (base_type(prog->aux->ctx_arg_info[i].reg_type) == PTR_TO_ARENA)
> +			return true;
> +	return false;
> +}
> +

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31047716344