linux-kernel - Re: [PATCH v2] docs/bpf: clarify ret handling in LSM BPF programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACYkzJ7X2uU=c7Qd+LUKnQbzSMyypnUu_WCMZ=8eX6ThXn_L6g@mail.gmail.com>
Date: Wed, 17 Sep 2025 11:31:05 +0200
From: KP Singh <kpsingh@...nel.org>
To: Ariel Silver <arielsilver77@...il.com>
Cc: bpf@...r.kernel.org, linux-doc@...r.kernel.org, 
	linux-kernel@...r.kernel.org, mattbobrowski@...gle.com, ast@...nel.org, 
	daniel@...earbox.net, andrii@...nel.org, martin.lau@...ux.dev, 
	eddyz87@...il.com, song@...nel.org, yonghong.song@...ux.dev, 
	john.fastabend@...il.com, sdf@...ichev.me, haoluo@...gle.com, 
	jolsa@...nel.org, corbet@....net
Subject: Re: [PATCH v2] docs/bpf: clarify ret handling in LSM BPF programs

On Thu, Sep 11, 2025 at 12:52 PM Ariel Silver <arielsilver77@...il.com> wrote:
>
> v2: Fixed trailing whitespace (reported by checkpatch.pl)
>
> Docs currently suggest that all attached BPF LSM programs always run
> and that ret simply carries the previous return code. In reality,
> execution stops as soon as one program returns non-zero. This is
> because call_int_hook() breaks out of the loop when RC != 0, so later
> programs are not executed.
>
> Signed-off-by: arielsilver77@...il.com <arielsilver77@...il.com>
> ---
>  Documentation/bpf/prog_lsm.rst | 12 ++++--------
>  1 file changed, 4 insertions(+), 8 deletions(-)
>
> diff --git a/Documentation/bpf/prog_lsm.rst b/Documentation/bpf/prog_lsm.rst
> index ad2be02f3..92bfb64c2 100644
> --- a/Documentation/bpf/prog_lsm.rst
> +++ b/Documentation/bpf/prog_lsm.rst
> @@ -66,21 +66,17 @@ example:
>
>     SEC("lsm/file_mprotect")
>     int BPF_PROG(mprotect_audit, struct vm_area_struct *vma,
> -            unsigned long reqprot, unsigned long prot, int ret)
> +            unsigned long reqprot, unsigned long prot)
>     {
> -       /* ret is the return value from the previous BPF program
> -        * or 0 if it's the first hook.
> -        */
> -       if (ret != 0)
> -           return ret;
> -

This is correct as of today, the return value is checked implicitly by
the generated trampoline and the next program in the chain is only
called if this is zero as BPF LSM programs use the modify return
trampoline:

in invoke_bpf_mod_ret:

/* mod_ret prog stored return value into [rbp - 8]. Emit:
* if (*(u64 *)(rbp - 8) != 0)
* goto do_fexit;
*/
/* cmp QWORD PTR [rbp - 0x8], 0x0 */
EMIT4(0x48, 0x83, 0x7d, 0xf8); EMIT1(0x00);

Acked-by: KP Singh <kpsingh@...nel.org>