Commit 6c212850 authored by Ihor Solodrai's avatar Ihor Solodrai Committed by Alexei Starovoitov
Browse files

bpf: Fix exception exit lock checking for subprogs 

process_bpf_exit_full() passes check_lock = !curframe to
check_resource_leak(), which is false in cases when bpf_throw() is
called from a static subprog. This makes check_resource_leak() to skip
validation of active_rcu_locks, active_preempt_locks, and
active_irq_id on exception exits from subprogs.

At runtime bpf_throw() unwinds the stack via ORC without releasing any
user-acquired locks, which may cause various issues as the result.

Fix by setting check_lock = true for exception exits regardless of
curframe, since exceptions bypass all intermediate frame
cleanup. Update the error message prefix to "bpf_throw" for exception
exits to distinguish them from normal BPF_EXIT.

Fix reject_subprog_with_rcu_read_lock test which was previously
passing for the wrong reason. Test program returned directly from the
subprog call without closing the RCU section, so the error was
triggered by the unclosed RCU lock on normal exit, not by
bpf_throw. Update __msg annotations for affected tests to match the
new "bpf_throw" error prefix.

The spin_lock case is not affected because they are already checked [1]
at the call site in do_check_insn() before bpf_throw can run.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h=v7.0-rc4#n21098



Assisted-by: Claude:claude-opus-4-6
Fixes: f18b03fa ("bpf: Implement BPF exceptions")
Signed-off-by: default avatarIhor Solodrai <ihor.solodrai@linux.dev>
Acked-by: default avatarYonghong Song <yonghong.song@linux.dev>
Acked-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260320000809.643798-1-ihor.solodrai@linux.dev


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 146bd2a8

kernel/bpf/verifier.c

+2 −1
Original line number Diff line number Diff line
@@ -20911,7 +20911,8 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env, 
	 * state when it exits.

	 */

	int err = check_resource_leak(env, exception_exit,

				      !env->cur_state->curframe,

				      exception_exit || !env->cur_state->curframe,

				      exception_exit ? "bpf_throw" :

				      "BPF_EXIT instruction in main prog");

	if (err)

		return err;

tools/testing/selftests/bpf/progs/exceptions_fail.c

+6 −3
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 
#include "bpf_experimental.h"



extern void bpf_rcu_read_lock(void) __ksym;

extern void bpf_rcu_read_unlock(void) __ksym;



#define private(name) SEC(".bss." #name) __hidden __attribute__((aligned(8)))
@@ -131,7 +132,7 @@ int reject_subprog_with_lock(void *ctx) 
}



SEC("?tc")

__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region")

__failure __msg("bpf_throw cannot be used inside bpf_rcu_read_lock-ed region")

int reject_with_rcu_read_lock(void *ctx)

{

	bpf_rcu_read_lock();
@@ -147,11 +148,13 @@ __noinline static int throwing_subprog(struct __sk_buff *ctx) 
}



SEC("?tc")

__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region")

__failure __msg("bpf_throw cannot be used inside bpf_rcu_read_lock-ed region")

int reject_subprog_with_rcu_read_lock(void *ctx)

{

	bpf_rcu_read_lock();

	return throwing_subprog(ctx);

	throwing_subprog(ctx);

	bpf_rcu_read_unlock();

	return 0;

}



static bool rbless(struct bpf_rb_node *n1, const struct bpf_rb_node *n2)