Re: [PATCH bpf-next v5 02/14] bpf: Split subprogram and kfunc collection

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 92d0cdd95c0f4..4573df98b1ce7 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2842,7 +2842,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16 offset)
>  	return 0;
>  }
>
> -static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
> +static int add_subprogs(struct bpf_verifier_env *env)
>  {
>  	struct bpf_subprog_info *subprog = env->subprog_info;
>  	int i, ret, insn_cnt = env->prog->len, ex_cb_insn;
> @@ -2854,8 +2854,7 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
>  		return ret;
>
>  	for (i = 0; i < insn_cnt; i++, insn++) {
> -		if (!bpf_pseudo_func(insn) && !bpf_pseudo_call(insn) &&
> -		    !bpf_pseudo_kfunc_call(insn))
> +		if (!bpf_pseudo_func(insn) && !bpf_pseudo_call(insn))
>  			continue;
>
>  		if (!env->bpf_capable) {
> @@ -2863,11 +2862,7 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
>  			return -EPERM;
>  		}
>
> -		if (bpf_pseudo_func(insn) || bpf_pseudo_call(insn))
> -			ret = add_subprog(env, i + insn->imm + 1);
> -		else
> -			ret = bpf_add_kfunc_call(env, insn->imm, insn->off);
> -
> +		ret = add_subprog(env, i + insn->imm + 1);
>  		if (ret < 0)
>  			return ret;
>  	}

[ ... ]

> @@ -2905,6 +2900,28 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
>  	return 0;
>  }
>
> +static int add_kfuncs(struct bpf_verifier_env *env)
> +{
> +	struct bpf_insn *insn = env->prog->insnsi;
> +	int i, ret, insn_cnt = env->prog->len;
> +
> +	for (i = 0; i < insn_cnt; i++, insn++) {
> +		if (!bpf_pseudo_kfunc_call(insn))
> +			continue;
> +
> +		if (!env->bpf_capable) {
> +			verbose(env, "loading/calling other bpf or kernel functions are allowed for CAP_BPF and CAP_SYS_ADMIN\n");
> +			return -EPERM;
> +		}
> +
> +		ret = bpf_add_kfunc_call(env, insn->imm, insn->off);
> +		if (ret < 0)
> +			return ret;
> +	}
> +
> +	return 0;
> +}

This isn't a bug, but now that the CAP_BPF check runs in two separate
functions, would it help to say "bpf function calls" in add_subprogs()
and "kernel function calls" in add_kfuncs() so the rejection reason is
unambiguous?

The message "loading/calling other bpf or kernel functions are allowed
for CAP_BPF and CAP_SYS_ADMIN" appears verbatim in both add_subprogs()
and add_kfuncs(). Before the split there was a single site covering
both cases; with two independent passes the identical string no longer
tells the loader which kind of call was rejected.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31231521120