linux-kernel - Re: [PATCH bpf-next 0/4] Use correct destructor kfunc types

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f82341df-bf2a-4913-a58c-e0acdfb245d2@linux.dev>
Date: Fri, 25 Jul 2025 09:54:25 -0700
From: Yonghong Song <yonghong.song@...ux.dev>
To: Sami Tolvanen <samitolvanen@...gle.com>
Cc: bpf@...r.kernel.org, Vadim Fedorenko <vadim.fedorenko@...ux.dev>,
 Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>,
 Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau
 <martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>,
 Song Liu <song@...nel.org>, John Fastabend <john.fastabend@...il.com>,
 KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>,
 Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
 Jamal Hadi Salim <jhs@...atatu.com>, Cong Wang <xiyou.wangcong@...il.com>,
 Jiri Pirko <jiri@...nulli.us>, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next 0/4] Use correct destructor kfunc types



On 7/25/25 9:22 AM, Sami Tolvanen wrote:
> Hi,
>
> On Fri, Jul 25, 2025 at 9:05 AM Yonghong Song <yonghong.song@...ux.dev> wrote:
>> I tried your patch set on top of latest bpf-next. The problem
>> still exists with the following error:
>>
>> [   71.976265] CFI failure at bpf_obj_free_fields+0x298/0x620 (target: __bpf_crypto_ctx_release+0x0/0x10; expected type: 0xc1113566)
>> [   71.980134] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
>> ...
>>
>>
>> The following is the CFI related config items:
>>
>> $ grep CFI .config
>> CONFIG_CFI_AUTO_DEFAULT=y
>> CONFIG_FUNCTION_PADDING_CFI=11
>> CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
>> CONFIG_ARCH_USES_CFI_TRAPS=y
>> CONFIG_CFI_CLANG=y
>> # CONFIG_CFI_ICALL_NORMALIZE_INTEGERS is not set
>> CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y
>> CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC=y
>> # CONFIG_CFI_PERMISSIVE is not set
>>
>> Did I miss anything?
> Interesting. I tested this on arm64 and confirmed that the issue is
> fixed there, so I wonder if we need to use KCFI_REFERENCE() here to
> make sure objtool / x86 runtime patching knows this function actually
> indirectly called. I'll test this on x86 and see what's going on.

I just tried arm64 with your patch set. CFI crash still happened:

CFI failure at tcp_ack+0xe74/0x13cc (target: bpf__tcp_congestion_ops_in_ack_event+0x0/0x78; expected type: 0x64424
87a)
Internal error: Oops - CFI: 00000000f2008228 [#1]  SMP
Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)]
CPU: 0 UID: 0 PID: 152 Comm: test_progs Tainted: G           OE       6.16.0-rc6-g95993dc3039e-dirty #162 NONE
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: linux,dummy-virt (DT)
pstate: 33400005 (nzCV daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : tcp_ack+0xe74/0x13cc
lr : tcp_ack+0xe34/0x13cc

The arm64 CFI related config:
$ cat .config | grep CFI
CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y
CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
CONFIG_CFI_CLANG=y
# CONFIG_CFI_ICALL_NORMALIZE_INTEGERS is not set
CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y
# CONFIG_CFI_PERMISSIVE is not set

>
> Thanks for taking a look!
>
> Sami