Re: [PATCH bpf-next v1] bpf: Fix unaligned interpreter panic on JIT fallback path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Type confusion between BPF helper enum IDs and address offsets in `bpf_fixup_fallback_inline_helpers()` leads to potential silent instruction corruption.
--

commit e06144ee47e54fe6934472bff4024530f26b7737
Author: Tiezhu Yang <yangtiezhu@loongson.cn>

bpf: Fix unaligned interpreter panic on JIT fallback path

This commit introduces a fallback fixup phase to rewrite the call offsets
for inlined helpers when JIT compilation fails or is skipped. This prevents
unaligned memory access panics when falling back to the interpreter.

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 649cce41e13f3..de0c46b495b40 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
[ ... ]
> @@ -2608,6 +2608,30 @@ static struct bpf_prog *bpf_prog_jit_compile(struct bpf_verifier_env *env, struc
>  	return prog;
>  }
>  
> +/*
> + * Rewrite the helper call offset for inlined helpers when fallback to
> + * the interpreter happens due to JIT compilation failure or JIT disabled.
> + */
> +static void bpf_fixup_fallback_inline_helpers(struct bpf_verifier_env *env, struct bpf_prog *fp)
> +{
> +	struct bpf_insn *insn = fp->insnsi;
> +	const struct bpf_func_proto *fn;
> +	int i;
> +
> +	if (!env || !env->ops->get_func_proto)
> +		return;
> +
> +	for (i = 0; i < fp->len; i++, insn++) {
> +		if (insn->code == (BPF_JMP | BPF_CALL) && insn->src_reg == 0) {
> +			if (bpf_jit_inlines_helper_call(insn->imm)) {

[Severity: High]
Could this cause a type confusion where a patched address offset is
misinterpreted as a helper enum ID?

Since bpf_do_misc_fixups() already patches insn->imm with a 32-bit address
offset (fn->func - __bpf_call_base) for helpers that are NOT expected to be
inlined by the JIT, insn->imm will already be an offset when reaching this
loop for non-inlined helpers.

If the distance between a non-inlined helper and __bpf_call_base happens to
match the enum ID of an inlined helper (for example,
BPF_FUNC_get_smp_processor_id = 8), wouldn't bpf_jit_inlines_helper_call()
falsely return true?

> +				fn = env->ops->get_func_proto(insn->imm, fp);
> +				if (fn && fn->func)
> +					insn->imm = fn->func - __bpf_call_base;

If the type confusion triggers, it seems this line would overwrite the
original, correct offset with the offset of an entirely different helper
function, potentially causing the interpreter to execute the wrong helper.

> +			}
> +		}
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611070009.26257-1-yangtiezhu@loongson.cn?part=1