linux-kernel - Re: [RFC bpf-next v2 1/1] libbpf: add compile-time OOB warning to bpf_tail_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ca64e62b-740e-4e02-a386-e1016317b071@linux.dev>
Date: Fri, 5 Sep 2025 08:54:45 -0700
From: Yonghong Song <yonghong.song@...ux.dev>
To: Hoyeon Lee <hoyeon.lee@...e.com>
Cc: netdev@...r.kernel.org, Andrii Nakryiko <andrii@...nel.org>,
 Eduard Zingerman <eddyz87@...il.com>, Alexei Starovoitov <ast@...nel.org>,
 Daniel Borkmann <daniel@...earbox.net>,
 Martin KaFai Lau <martin.lau@...ux.dev>, Song Liu <song@...nel.org>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
 Jiri Olsa <jolsa@...nel.org>, Nathan Chancellor <nathan@...nel.org>,
 Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
 Bill Wendling <morbo@...gle.com>, Justin Stitt <justinstitt@...gle.com>,
 "open list:BPF [LIBRARY] (libbpf)" <bpf@...r.kernel.org>,
 open list <linux-kernel@...r.kernel.org>,
 "open list:CLANG/LLVM BUILD SUPPORT:Keyword:b(?i:clang|llvm)b"
 <llvm@...ts.linux.dev>
Subject: Re: [RFC bpf-next v2 1/1] libbpf: add compile-time OOB warning to
 bpf_tail_call_static



On 9/4/25 10:18 PM, Hoyeon Lee wrote:
> Add a compile-time check to bpf_tail_call_static() to warn when a
> constant slot(index) >= map->max_entries. This uses a small
> BPF_MAP_ENTRIES() macro together with Clang's diagnose_if attribute.
>
> Clang front-end keeps the map type with a '(*max_entries)[N]' field,
> so the expression
>
>      sizeof(*(m)->max_entries) / sizeof(**(m)->max_entries)
>
> is resolved to N entirely at compile time. This allows diagnose_if()
> to emit a warning when a constant slot index is out of range.
>
> Out-of-bounds tail calls are currently silent no-ops at runtime, so
> emitting a compile-time warning helps detect logic errors earlier.
> This is currently limited to Clang (due to diagnose_if) and only for
> constant indices, but should still catch the common cases.
>
> Signed-off-by: Hoyeon Lee <hoyeon.lee@...e.com>
> ---
> Changes in V2:
> - add function definition for __bpf_tail_call_warn for compile error
>
>   tools/lib/bpf/bpf_helpers.h | 21 +++++++++++++++++++++
>   1 file changed, 21 insertions(+)
>
> diff --git a/tools/lib/bpf/bpf_helpers.h b/tools/lib/bpf/bpf_helpers.h
> index 80c028540656..98bc1536c497 100644
> --- a/tools/lib/bpf/bpf_helpers.h
> +++ b/tools/lib/bpf/bpf_helpers.h
> @@ -173,6 +173,27 @@ bpf_tail_call_static(void *ctx, const void *map, const __u32 slot)
>   		     :: [ctx]"r"(ctx), [map]"r"(map), [slot]"i"(slot)
>   		     : "r0", "r1", "r2", "r3", "r4", "r5");
>   }
> +
> +#if __has_attribute(diagnose_if)
> +static __always_inline void __bpf_tail_call_warn(int oob)
> +	__attribute__((diagnose_if(oob, "bpf_tail_call: slot >= max_entries",
> +				   "warning"))) {};
> +
> +#define BPF_MAP_ENTRIES(m) \
> +	((__u32)(sizeof(*(m)->max_entries) / sizeof(**(m)->max_entries)))
> +
> +#ifndef bpf_tail_call_static
> +#define bpf_tail_call_static(ctx, map, slot)				      \
> +({									      \
> +	/* wrapped to avoid double evaluation. */                             \
> +	const __u32 __slot = (slot);                                          \
> +	__bpf_tail_call_warn(__slot >= BPF_MAP_ENTRIES(map));                 \
> +	/* Avoid re-expand & invoke original as (bpf_tail_call_static)(..) */ \
> +	(bpf_tail_call_static)(ctx, map, __slot);                             \
> +})
> +#endif /* bpf_tail_call_static */
> +#endif

I got the following error with llvm21.

progs/tailcall_bpf2bpf3.c:20:3: error: bpf_tail_call: slot >= max_entries [-Werror,-Wuser-defined-warnings]
    20 |                 bpf_tail_call_static(skb, &jmp_table,progs/tailcall_bpf2bpf2.c:17:3 10);
       | :                ^
  /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:190:53: note: expanded from macro
       'bpf_tail_call_static'
   190 |         __bpf_tail_call_warn(__slot >= BPF_MAP_ENTRIES(map));                 \
       |                                                            ^
/home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:179:17: note: from 'diagnose_if'
       attribute on '__bpf_tail_call_warn':
   179 |         __attribute__((diagnose_if(oob, "bpf_tail_call: slot >= max_entries",
       |                        ^           ~~~
error: bpf_tail_call: slot >= max_entries [-Werror,-Wuser-defined-warnings]
    17 |                 bpf_tail_call_static(skb, &jmp_table, 1);
       |                 ^
/home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:190:53: note: expanded from macro
       'bpf_tail_call_static'
   190 |         __bpf_tail_call_warn(__slot >= BPF_MAP_ENTRIES(map));                 \
       |                                                            ^
/home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:179:17: note: from 'diagnose_if'
       attribute on '__bpf_tail_call_warn':
   179 |         __attribute__((diagnose_if(oob, "bpf_tail_call: slot >= max_entries",
       |                        ^           ~~~
   CLNG-BPF [test_progs] tailcall_poke.bpf.o
1 error generated.
make: *** [Makefile:733: /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tailcall_bpf2bpf3.bpf.o] Error 1

> +
>   #endif
>   #endif
>
> --
> 2.51.0