[PATCH bpf-next v2 0/3] bpf: Disallow interpreter fallback for interpreter-unsupported insns

[Leon Hwang <leon.hwang@linux.dev>]

Sashiko reported two potential issues about interpreter fallback [1]
[2].

After verifying them by patch #7 of v1, I think they are real issues. With
LLM assistance, the interpreter does not support the internal
BPF_PROBE_ATOMIC insn and the gotox insn (used for indirect jumps),
either.

1) the user BPF_ADDR_SPACE_CAST insn
   the interpreter just ignores it.

2) the arena ST/STX/LDX insn
   the interpreter could hit the BUG_ON() in ___bpf_prog_run().

3) the BPF_MOV64_PERCPU_REG insn
   the interpreter could hit page fault, due to loading memory from
   invalid __percpu pointer.

4) the internal BPF_PROBE_ATOMIC insn
   the interpreter could hit the BUG_ON() in ___bpf_prog_run().

5) the gotox insn used for indirect jumps
   the interpreter could hit the BUG_ON() in ___bpf_prog_run(), too.

Reject these insns on interpreter fallback path in
__bpf_prog_select_runtime() by setting 'jit_required = true'.

Link:
[1] https://lore.kernel.org/bpf/20260608151347.2C77D1F00893@smtp.kernel.org/
[2] https://lore.kernel.org/bpf/20260622150759.EC9071F000E9@smtp.kernel.org/

Changes:
v1 -> v2:
* Drop RFC.
* Change target tree to bpf-next to utilize the 'jit_required' bit.
* Set jit_required as true if there's arena map, then all arena-related
  insns will be rejected if JIT is not available.
* Set jit_required as true if there's insn_array map, then the gotox
  insns will be rejected if JIT is not available.
* Drop the issues-proven patch.
* v1: https://lore.kernel.org/bpf/20260626154330.33619-1-leon.hwang@linux.dev/

Leon Hwang (3):
  bpf: Disallow interpreter fallback for arena-related insns
  bpf: Disallow interpreter fallback for gotox insn
  bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn

 include/linux/bpf.h   | 4 ++--
 kernel/bpf/fixups.c   | 5 +++++
 kernel/bpf/verifier.c | 2 ++
 3 files changed, 9 insertions(+), 2 deletions(-)

--
2.55.0