[PATCH] bpf: fix index register for classic BPF indirect loads

[PATCH] bpf: fix index register for classic BPF indirect loads

[Stephen Hemminger]

Classic BPF filters using a variable offset into the packet, such as
"tcp[tcpflags] & tcp-syn != 0" or "tcp[0:4] = ...", read the wrong bytes.

The indirect loads ldb/ld [x + k] were handled in the same case as the
arithmetic instructions, which take the source register from
BPF_SRC(code), that is bit 0x08. In a load opcode that bit is part of
the size field, not a K/X selector, so BPF_LD|BPF_IND|BPF_B (0x50) and
BPF_LD|BPF_IND|BPF_W (0x40) both yield BPF_K and the index register
becomes R0 (A) instead of R7 (X). The halfword form works only because
BPF_H and BPF_X are both 0x08.

Give the indirect loads their own case next to the absolute loads and
emit X as the index register. The interpreter and the JITs already
take the index from src_reg, so this fixes all engines.

Bugzilla ID: 2085
Fixes: 2eccf6afbea9 ("bpf: add function to convert classic BPF to DPDK BPF")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 lib/bpf/bpf_convert.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/bpf/bpf_convert.c b/lib/bpf/bpf_convert.c
index 37095eea52..a32e1cdd8a 100644
--- a/lib/bpf/bpf_convert.c
+++ b/lib/bpf/bpf_convert.c
@@ -301,6 +301,13 @@ static int bpf_convert_filter(const struct bpf_insn *prog, size_t len,
 			*insn = BPF_RAW_INSN(fp->code, 0, 0, 0, fp->k);
 			break;
 
+			/* Indirect loads index the packet with X: A = P[X + k] */
+		case BPF_LD | BPF_IND | BPF_W:
+		case BPF_LD | BPF_IND | BPF_H:
+		case BPF_LD | BPF_IND | BPF_B:
+			*insn = BPF_RAW_INSN(fp->code, 0, BPF_REG_X, 0, fp->k);
+			break;
+
 		case BPF_ALU | BPF_DIV | BPF_X:
 		case BPF_ALU | BPF_MOD | BPF_X:
 			/* For cBPF, don't cause floating point exception */
@@ -328,9 +335,6 @@ static int bpf_convert_filter(const struct bpf_insn *prog, size_t len,
 		case BPF_ALU | BPF_DIV | BPF_K:
 		case BPF_ALU | BPF_MOD | BPF_K:
 		case BPF_ALU | BPF_NEG:
-		case BPF_LD | BPF_IND | BPF_W:
-		case BPF_LD | BPF_IND | BPF_H:
-		case BPF_LD | BPF_IND | BPF_B:
 			/* All arithmetic insns map as-is. */
 			insn->code = fp->code;
 			insn->dst_reg = BPF_REG_A;
-- 
2.53.0

Re: [PATCH] bpf: fix index register for classic BPF indirect loads

[Stephen Hemminger]

On Tue, 27 Oct 2026 10:06:19 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> Classic BPF filters using a variable offset into the packet, such as
> "tcp[tcpflags] & tcp-syn != 0" or "tcp[0:4] = ...", read the wrong bytes.
> 
> The indirect loads ldb/ld [x + k] were handled in the same case as the
> arithmetic instructions, which take the source register from
> BPF_SRC(code), that is bit 0x08. In a load opcode that bit is part of
> the size field, not a K/X selector, so BPF_LD|BPF_IND|BPF_B (0x50) and
> BPF_LD|BPF_IND|BPF_W (0x40) both yield BPF_K and the index register
> becomes R0 (A) instead of R7 (X). The halfword form works only because
> BPF_H and BPF_X are both 0x08.
> 
> Give the indirect loads their own case next to the absolute loads and
> emit X as the index register. The interpreter and the JITs already
> take the index from src_reg, so this fixes all engines.
> 
> Bugzilla ID: 2085
> Fixes: 2eccf6afbea9 ("bpf: add function to convert classic BPF to DPDK BPF")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---

Reported-by: Anthropic OSS scanner (ANT-2026-O029C471)