Re: [PATCH v2 2/2] x86/cfi,bpf: Fix BPF JIT call

[Alexei Starovoitov]

On Fri, Dec 8, 2023 at 9:22 AM Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote:
>
> On Fri, Dec 08, 2023 at 02:40:41PM +0100, Peter Zijlstra wrote:
> > On Fri, Dec 08, 2023 at 11:29:40AM +0100, Peter Zijlstra wrote:
> > > The only problem I now have is the one XXX, I'm not entirely sure what
> > > signature to use there.
> >
> > > @@ -119,6 +119,7 @@ int bpf_struct_ops_test_run(struct bpf_p
> > >     op_idx = prog->expected_attach_type;
> > >     err = bpf_struct_ops_prepare_trampoline(tlinks, link,
> > >                                             &st_ops->func_models[op_idx],
> > > +                                           /* XXX */ NULL,
> > >                                             image, image + PAGE_SIZE);
> > >     if (err < 0)
> > >             goto out;
> >
> > Duh, that should ofcourse be something of dummy_ops_test_ret_fn type.
> > Let me go fix that.
>
> Next one.. bpf_obj_free_fields: field->kptr.dtor(xchg_field);
>
> The one that trips is bpf_cgroup_release().
>
> objtool doesn't think the address of that function 'escapes' and
> 'helpfully' seals that function, and then BPF thinks it does escape and
> manages the above indirect call and *boom*.
>
> How can I tell which functions escape according to BPF such that I might
> teach objtool this?

I'm not following.
Are you asking to annotate
__bpf_kfunc void bpf_cgroup_release(struct cgroup *cgrp)
somehow so that objtool knows that it will be called indirectly?
typedef void (*btf_dtor_kfunc_t)(void *);
        btf_dtor_kfunc_t dtor;
but the bpf_cgroup_release takes 'struct cgroup*'.
>From kcfi pov void * == struct cgroup * ?
Do we need to change it to 'void *cgrp' ?
What is "sealing" by objtool?