linux-kernel - Re: [PATCH] bpf: Mark kfuncs as _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <86de1bf6-83b0-4d31-904b-95af424a398a@linux.dev>
Date: Tue, 26 Aug 2025 13:17:31 -0700
From: Yonghong Song <yonghong.song@...ux.dev>
To: Andrea Righi <arighi@...dia.com>, Alexei Starovoitov <ast@...nel.org>,
 Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>
Cc: Martin KaFai Lau <martin.lau@...ux.dev>,
 Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
 Jiri Olsa <jolsa@...nel.org>, David Vernet <void@...ifault.com>,
 bpf@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] bpf: Mark kfuncs as __noclone



On 8/22/25 7:05 AM, Andrea Righi wrote:
> Some distributions (e.g., CachyOS) support building the kernel with -O3,
> but doing so may break kfuncs, resulting in their symbols not being
> properly exported.
>
> In fact, with gcc -O3, some kfuncs may be optimized away despite being
> annotated as noinline. This happens because gcc can still clone the
> function during IPA optimizations, e.g., by duplicating or inlining it
> into callers, and then dropping the standalone symbol. This breaks BTF
> ID resolution since resolve_btfids relies on the presence of a global
> symbol for each kfunc.
>
> Currently, this is not an issue for upstream, because we don't allow
> building the kernel with -O3, but it may be safer to address it anyway,
> to prevent potential issues in the future if compilers become more
> aggressive with optimizations.
>
> Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
> cloned and remain distinct, globally visible symbols, regardless of
> the optimization level.

I tried with gcc14 and can reproduced the issue described in the above.
I build the kernel like below with gcc14
   make KCFLAGS='-O3' -j
and get the following build error
   WARN: resolve_btfids: unresolved symbol bpf_strnchr
   make[2]: *** [/home/yhs/work/bpf-next/scripts/Makefile.vmlinux:91: vmlinux] Error 255
   make[2]: *** Deleting file 'vmlinux'
Checking the symbol table:
    22276: ffffffff81b15260   249 FUNC    LOCAL  DEFAULT    1 bpf_strnchr.cons[...]
   235128: ffffffff81b1f540   296 FUNC    GLOBAL DEFAULT    1 bpf_strnchr
and the disasm code:
   bpf_strnchr:
     ...

   bpf_strchr:
     ...
     bpf_strnchr.constprop.0
     ...

So in symbol table, we have both bpf_strnchr.constprop.0 and bpf_strnchr.
For such case, pahole will skip func bpf_strnchr hence the above resolve_btfids
failure.

The solution in this patch can indeed resolve this issue.

>
> Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
> Signed-off-by: Andrea Righi <arighi@...dia.com>
> ---
>   include/linux/btf.h | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/btf.h b/include/linux/btf.h
> index 9eda6b113f9b4..f06976ffb63f9 100644
> --- a/include/linux/btf.h
> +++ b/include/linux/btf.h
> @@ -86,7 +86,7 @@
>    * as to avoid issues such as the compiler inlining or eliding either a static
>    * kfunc, or a global kfunc in an LTO build.
>    */
> -#define __bpf_kfunc __used __retain noinline
> +#define __bpf_kfunc __used __retain __noclone noinline
>   
>   #define __bpf_kfunc_start_defs()					       \
>   	__diag_push();							       \

The llvm does not support __noclone so __noclone is noop for llvm.
I tried with
   make KCFLAGS='-O3' LLVM=1 -j
and the kernel is build successfully and also the kernel can boot properly.

So ack the patch:
Acked-by: Yonghong Song <yonghong.song@...ux.dev>