diff options
| author | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2026-08-13 01:15:05 +0200 |
|---|---|---|
| committer | Andrii Nakryiko <andrii@kernel.org> | 2026-08-13 14:41:30 -0700 |
| commit | aacd13e1eb68f2c9049fc0cf7aed89694c3e0713 (patch) | |
| tree | 3b4859a57480b31bcb2572d484680be9a85beca3 /kernel | |
| parent | 806c1a185215382fab5a7fafc74e30070b2fb043 (diff) | |
bpf: Fix func_info_aux desync after dead code elimination
The verifier keeps per-subprogram metadata in three parallel arrays:
subprog_info, func_info, and func_info_aux. Dead code elimination can
remove whole subprograms, and adjust_subprog_starts_after_remove()
shifts subprog_info and func_info to close the gap, but leaves
func_info_aux in place. From that point on, func_info_aux[i] no longer
describes subprogram i.
Shift func_info_aux together with func_info so the three arrays stay
aligned after subprogram removal.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260808064523.DE3E71F000E9@smtp.kernel.org
Link: https://lore.kernel.org/bpf/20260812231506.3558128-1-memxor@gmail.com
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/fixups.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c index 177a3fcbb63a..70f22eb63ed5 100644 --- a/kernel/bpf/fixups.c +++ b/kernel/bpf/fixups.c @@ -402,13 +402,17 @@ static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env, sizeof(*env->subprog_info) * move); env->subprog_cnt -= j - i; - /* remove func_info */ + /* remove func_info and its aux */ if (aux->func_info) { move = aux->func_info_cnt - j; memmove(aux->func_info + i, aux->func_info + j, sizeof(*aux->func_info) * move); + if (aux->func_info_aux) + memmove(aux->func_info_aux + i, + aux->func_info_aux + j, + sizeof(*aux->func_info_aux) * move); aux->func_info_cnt -= j - i; /* func_info->insn_off is set after all code rewrites, * in adjust_btf_func() - no need to adjust |