Re: [PATCH v10 7/8] powerpc/bpf: fix buffer overflow in JIT for large BPF programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Inverted pass condition in `bpf_add_extable_entry()` causes JIT compilation failure and stale exception tables.
--

--- Patch [7]: [PATCH v10 7/8] powerpc/bpf: fix buffer overflow in JIT for large BPF programs ---
commit 7c6fc2cfb9f061eb19bae10ea234d06c7a76903c
Author: Abhishek Dubey <adubey@linux.ibm.com>

powerpc/bpf: fix buffer overflow in JIT for large BPF programs

This commit modifies the code-generation loop to iterate until the program size
converges, bounded by CODEGEN_MAX_PASSES, to prevent buffer overflows during JIT 
compilation of large BPF programs. It also ensures exit_addr is non-zero before 
treating it as in-range and resets alt_exit_addr before subsequent passes.

Link: https://lore.kernel.org/bpf/20260529015855.364704-2-adubey@linux.ibm.com/T/#mfcb23909d977b949727cca4f59ee56a13fd69b92

> diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
> index 8be5ded13a4a6..3c20bb13cfd70 100644
> --- a/arch/powerpc/net/bpf_jit_comp.c
> +++ b/arch/powerpc/net/bpf_jit_comp.c

[ ... ]

> @@ -428,7 +446,7 @@ int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, u32 *fimage, int pass
>  	u32 *fixup;
>  
>  	/* Populate extable entries only in the last pass */
> -	if (pass != 2)
> +	if (pass >= CODEGEN_MIN_PASSES)
>  		return 0;
>  
>  	if (!fp->aux->extable ||

[Severity: High]
Does this accidentally invert the logic for populating the exception table?

The comment says to populate extable entries only in the last pass, but returning 0
when pass >= CODEGEN_MIN_PASSES means it will skip the final code generation passes
and instead execute during the early passes.

During the scouting pass 0 in bpf_int_jit_compile(), pass >= CODEGEN_MIN_PASSES
evaluates to false, causing it to fall through. Since the exception table
is not yet allocated at this stage, bpf_add_extable_entry() returns -EINVAL
and unconditionally fails JIT compilation for any BPF program with exceptions.

Additionally, for programs taking the extra_pass path, this would cause the extable
population to be skipped during the final passes. Because instructions can shrink 
between passes, this might leave stale extable offsets that point to incorrect 
locations, which could trigger a kernel panic during unhandled page faults.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785906979.git.skb99@linux.ibm.com?part=7