Skip to contentSkip to conversation

bpf: reject BPF_PSEUDO_FUNC reference to the main program

PATCH Applied Eduard Zingerman 2 participants 3 messages Sep 2 – Sep 3

Subsystems (4)
Kselftest BPF BPF selftests BPF core
lore
Share & tools
lore

Eduard Zingerman

author maintainer
#0 lore raw

PATCH 1/2 bpf: reject BPF_PSEUDO_FUNC reference to the main program

fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below:

  int main(void *ctx) {
    void *ptr = main;
    ...
    bpf_timer_set_callback(..., ptr);
    ...
  }

The 'ptr' won't be ever converted to contain an address.
In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address.

Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram.

Fixes 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Reported-by Nicholas Carlini <[email protected]>
Suggested-by Nicholas Carlini <[email protected]>
Signed-off-by Eduard Zingerman <[email protected]>
---
 kernel/bpf/verifier.c | 9 +++++++++
 1 file changed, 9 insertions(+)
kernel/bpf/verifier.c +9 -0
index e64035683795..7d8ddb1bee00 100644
@@ -17089,6 +17089,15 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
 			verbose(env, "callback function not static\n");
 			return -EINVAL;
 		}
+		/*
+		 * When env->subprog_cnt == 1 this instruction won't be rewritten
+		 * to hold a real function address. Assume that no usable program
+		 * combines e.g. main and timer callback and just reject here.
+		 */
+		if (subprogno == 0) {
+			verbose(env, "callback function cannot be the main program\n");
+			return -EINVAL;
+		}
 
 		dst_reg->type = PTR_TO_FUNC;
 		dst_reg->subprogno = subprogno;
Signature · 1 line
2.55.0
author maintainer
#1 lore raw

PATCH 2/2 selftests/bpf: BPF_PSEUDO_FUNC reference to the main program

Add a test case for a BPF_PSEUDO_FUNC load instruction that references the entry function of the program it belongs to. W/o the previous patch the verifier accepts this program thus allowing a runtime call at a bogus address. See previous patch for detailed description.

Main function needs to be marked with BTF_FUNC_STATIC for the test to trigger the bug, the patch uses test_verifier harness instead of test_prog because libbpf has no way to convey this.

Reported-by Nicholas Carlini <[email protected]>
Suggested-by Nicholas Carlini <[email protected]>
Signed-off-by Eduard Zingerman <[email protected]>
---
 .../selftests/bpf/verifier/pseudo_func.c      | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/verifier/pseudo_func.c
tools/testing/selftests/bpf/verifier/pseudo_func.c new file +45 -0
new file mode 100644
index 000000000000..63c5c67d51de
@@ -0,0 +1,45 @@
+/*
+ * Buggy verifier accepted the program below while not patching BPF_PSEUDO_FUNC
+ * load instruction to contain a real address. Which resulted in a function call
+ * to a bogus address.
+ */
+{
+	"BPF_PSEUDO_FUNC reference to the main program",
+	.insns = {
+	/* r6 = bpf_map_lookup_elem(&timer_map, &(int){0}); */
+	BPF_ST_MEM(BPF_W, BPF_REG_10, -4, 0),
+	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+	BPF_LD_MAP_FD(BPF_REG_1, 0),
+	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
+	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+	/* bpf_timer_init(r6, &timer_map, 0); */
+	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+	BPF_LD_MAP_FD(BPF_REG_2, 0),
+	BPF_MOV64_IMM(BPF_REG_3, 0),
+	BPF_EMIT_CALL(BPF_FUNC_timer_init),
+	/* bpf_timer_set_callback(r6, <insn #0>); */
+	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, -15),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_EMIT_CALL(BPF_FUNC_timer_set_callback),
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+	.fixup_map_timer = { 3, 9 },
+	.result = REJECT,
+	.errstr = "callback function cannot be the main program",
+	.func_info = { { 0, 4 /* main_prog */ } },
+	.func_info_cnt = 1,
+	.btf_strings = "\0int\0ctx\0main_prog",
+	.btf_types = {
+	/* 1: int            */ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),
+	/* 2: void*          */ BTF_PTR_ENC(0),
+	/* 3: int __(void *) */ BTF_FUNC_PROTO_ENC(1, 1),
+				BTF_FUNC_PROTO_ARG_ENC(5, 2),
+	/* 4: main_prog      */ BTF_FUNC_ENC(9, 3),
+	BTF_END_RAW
+	}
+},
Signature · 1 line
2.55.0
CI Applied
#2 lore raw
In reply to Eduard Zingerman
This series was applied to bpf/bpf.git (master) by Alexei Starovoitov <[email protected]>:

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <[email protected]>:

Quoted 5 lines · On Wed, 2 Sep 2026 16:36:57 -0700 you wrote:

fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below:

Quoted 8 lines
  int main(void *ctx) {
    void *ptr = main;
    ...
    bpf_timer_set_callback(..., ptr);
    ...
  }

[...]

Here is the summary with links:
- [bpf,1/2] bpf: reject BPF_PSEUDO_FUNC reference to the main program

    https://git.kernel.org/bpf/bpf/c/374b2c5561db
  - [bpf,2/2] selftests/bpf: BPF_PSEUDO_FUNC reference to the main program
    https://git.kernel.org/bpf/bpf/c/ac0aaef0aa99

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html