Re: [PATCH v2 2/2] x86/cfi,bpf: Fix BPF JIT call

[Peter Zijlstra]

On Fri, Dec 08, 2023 at 02:40:41PM +0100, Peter Zijlstra wrote:
> On Fri, Dec 08, 2023 at 11:29:40AM +0100, Peter Zijlstra wrote:
> > The only problem I now have is the one XXX, I'm not entirely sure what
> > signature to use there.
> 
> > @@ -119,6 +119,7 @@ int bpf_struct_ops_test_run(struct bpf_p
> >  	op_idx = prog->expected_attach_type;
> >  	err = bpf_struct_ops_prepare_trampoline(tlinks, link,
> >  						&st_ops->func_models[op_idx],
> > +						/* XXX */ NULL,
> >  						image, image + PAGE_SIZE);
> >  	if (err < 0)
> >  		goto out;
> 
> Duh, that should ofcourse be something of dummy_ops_test_ret_fn type.
> Let me go fix that.

Next one.. bpf_obj_free_fields: field->kptr.dtor(xchg_field);

The one that trips is bpf_cgroup_release().

objtool doesn't think the address of that function 'escapes' and
'helpfully' seals that function, and then BPF thinks it does escape and
manages the above indirect call and *boom*.

How can I tell which functions escape according to BPF such that I might
teach objtool this?