selftests/bpf: Fix callback recursion test with noipa global func

With llvm24 after commit 28b4a2032f97 ("[BPF] Mark global functions
noipa"), the test recursion_via_global_func_and_callback fails:

  13: (85) call bpf_loop#181 4: frame1: R1=scalar() R10=fp0 cb
  ; return static_calls_global(i); @ verifier_global_subprogs.c:548
  4: (85) call pc+1
  ...
  ; return global_calls_loop(x); @ verifier_global_subprogs.c:543
  6: (85) call pc+1
  Func#3 ('global_calls_loop') is global and assumed valid.
  7: frame2: R0=scalar()
  7: (95) exit
  ...
  ; return static_calls_global(i); @ verifier_global_subprogs.c:548
  5: (95) exit
  At callback return the register R0 has unknown scalar value should have been in [0, 1]
  =============
  EXPECTED   SUBSTR: 'recursive call from global_calls_loop() to loop_cb_calls_static()'
   #669/9   verifier_global_subprogs/recursion_via_global_func_and_callback:FAIL

The callback loop_cb_calls_static() returns the result of
static_calls_global(), which in turn returns the result of the global
function global_calls_loop().

Before the above llvm24 commit, IPSCCP (interprocedural sparse
conditional constant propagation) could fold the return value of
global_calls_loop() into its callers. global_calls_loop() is not
static, but it has a non-weak definition in the same compilation unit,
so IPSCCP may assume that definition is the one called. It found that
global_calls_loop() always returns 0 and replaced the uses of the call
result with 0, which made static_calls_global() and then
loop_cb_calls_static() return a constant 0 as well. The calls stay, only
their return values are replaced. So the callback set R0 to 0 itself,
passed the bpf_loop callback return range check, and verification went
on to report the expected recursion.

The llvm24 commit marks global functions noipa, since the verifier
checks a global function only against its BTF prototype and freplace
can replace it. With noipa, IPSCCP no longer propagates the return
value of global_calls_loop() to callers. The verifier does not look
into a global function either, so R0 after the call is an unknown
scalar, and the callback return check fails before the recursion is
detected.

Make static_calls_global() return void and let loop_cb_calls_static()
return 0 explicitly. The call chain the test is about stays the same,
and the test passes with both llvm24 and earlier versions (e.g. llvm21
to llvm23).

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://github.com/llvm/llvm-project/pull/237690
Link: https://patch.msgid.link/20261102192727.762933-1-yonghong.song@linux.dev
This commit is contained in:
Yonghong Song 2026-11-02 11:27:27 -08:00 committed by Alexei Starovoitov
parent c5973f3067
commit fdda033f7f
No known key found for this signature in database

View File

@ -538,14 +538,15 @@ int return_from_void_global(struct __sk_buff *skb)
int global_calls_loop(int x);
static __noinline int static_calls_global(int x)
static __noinline void static_calls_global(int x)
{
return global_calls_loop(x);
global_calls_loop(x);
}
static __noinline int loop_cb_calls_static(u32 i, void *ctx)
{
return static_calls_global(i);
static_calls_global(i);
return 0;
}
__noinline int global_calls_loop(int x)