From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.43 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793361148; b=waRwxcucWjprORr9XUozIu/VMw3wzXvr9btwYnrSGoZSRj1EoW8FyJB4j+aqoiaZM7py YVPTYAhcmzwWRncFCW5IsRSoV4ESSfwFX9BgudbLzV1GP4IleS1PzItHLM3gR5TAbD2qU rw+y1WGo8D8CY2bsIL2qWi4+cDNm89UrUu8BnvnoAMR/XrIY6AKK+AAULWtSU5uc15MDq q5NACZ+56nYzRA8bT4CfQk7TY06qkiiuhH/q1Rw25ruVQVEwCnMPnkNMDR4vpLmK/z6+J GKTCZca15RjBFKruGjVQOxcL8+xmE+jlic8H/YwXz4ukXuiH+R7o7r1/acf/q6eiu1g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793361148; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:Date:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding: Message-Id:References:In-Reply-To:To:Cc:X-Mailer; bh=xlFJ7GxYpC5EWMxIsQaH4NQ1xOX2nqD7BFPSqffaoss=; b=csujeIRTvn/LemAnymki8cuZMg3uEyDmgXLBhtCNt4MXzcLxWN43XG8M69hsYTtrK79M hj/j3wLWr4TP5k38aPzbW2J5G7zdEL5+bRUNoJiLwpR5TitSUYhAfEXiFhbsvg1axdUpY EoeeDmlHhDryHIZjsCBzD0VAi4+Duor1iFQAghYa4Ncrx15UkWlcCsfzDetWvxA9p7z65 /s6CHcao2cqF+ZeMx6mV25BCwIsnjbrcMiOfUw5VO+3SOJz6bE1vkjIthDkDCJQx9LoNQ amf5k4LC5ZCUd14uQrmmL0WwPKh0ZGCXs8bZXZMgivGaWQzgwFNia9otqcyoEvThztA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=tn3+2EVE; arc=none smtp.remote-ip=74.125.82.43 Received: from mail-dl1-f43.google.com (mail-dl1-f43.google.com [74.125.82.43]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 656DF606A31D for ; Fri, 30 Oct 2026 11:52:28 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 656DF606A31D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=tn3+2EVE Received: by mail-dl1-f43.google.com with SMTP id a92af1059eb24-170135e43c7so866415c88.0 for ; Fri, 30 Oct 2026 04:52:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793361147; x=1793965947; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xlFJ7GxYpC5EWMxIsQaH4NQ1xOX2nqD7BFPSqffaoss=; b=tn3+2EVE9VsxwlCaUiZdSdLVlwb/v0LnryO6LnbLY8j3QiEm6249BpnLNTY/KWFTdt 66/QA3JH0cBHo6rKkhoE2LBCdyA/1rhThK85SvImlToRzwA99LWFZRP02smBQOva3oZh qxsrSiPZ9AehYWd4zQwLTCnAWEmJY+iQYFHkxMyqq/X1rPn6iFv6Hur0GfWkg1OKQQJv q0UlblrOJX+EinwDNmE3Au0C73k6pONf8AlMXmXWBIYVzPdVS+5u8PMQPfvgtlUgNkdl nUTAm8kvFYudk85w+QJdyBX13wAMGyXsist3Qpp4hI/f5yrGgOn7U3GIaASV8uxrj/jE bAYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793361147; x=1793965947; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=xlFJ7GxYpC5EWMxIsQaH4NQ1xOX2nqD7BFPSqffaoss=; b=c6OTDB1OwleXkSNgVUu7zzKd3+3DiWvgEYlpP6AcVshtLq9jPxijZXIMRpZghoEcwE 8Ttpzazzb6F4Qr28U+U+IkWZmubkQkr1OC8ReC3O7WbsRVeUzdrHg45ZPl1Q/v+mI8M/ /RIkaw3qOq56o54IaVP3r2NhU6YzBG+7kEo+xROrh4Gdd48WqH8Cdrj1bPmng9uO2rvU e8UOy5GzAShbGmWq7Kh7YIexzR0JOpbczzqUw4k6ZO3vtej29yAZdap1Ge2EUE9HIRz+ 9kjAjIYag2BXC1IUaevM+ezs3hQkOT+afLxfwBOPNtFCKdBa8/AJMl3GNo6jatz5GR/+ wz4A== X-Forwarded-Encrypted: i=1; AKwUvBzsgCSR8cCfIXUjaQ8QCglDT+v0pSlA/KvphQ7mWfh9eev68zvtRYoLGKynm1Va/RiDHBbgXrJKlbb3R5seDB0=@vger.kernel.org X-Gm-Message-State: AFq9FYLNMX3/z3UrQiu1xPGbkv2CJdvRH9sDbesYxAda5NCTt7vKgWIa +l0WTBkYaB8OBsYTFnhrA7VjiPqtP4OK6NXrDeE2EHImTrpUDH6M1JKo X-Gm-Gg: AYBFou3VaqMWKBDBivDPZYZxwYFZE9iHf6n9B2sF1nmyb3VZlUKv8QPwVPXn6TTF77T wXQ1JJ5c5y70jUSVquDfB+O8r6McHXnFjcH2FqmLLxFkpE1jahJKuXAYTaXXGXzaOY1hj1lxoQy 2AzzRMUVZ6anJPHnB9GR6nLZWlJDjf2cma+mfcg9frhjRmm5outLaDeakvwF/AEC3sYt48Cg12B uXXe05ycLYZMy343V/i3JILQMw0VzgrTmKDt34fCHy9nY81ut87WHRkzF8R/ksV7vtwgTF/Gfw1 y579Sa4JW5kJ+vpRbdNW8pvSYbT6xjYBjOkDxSjw50a+Ng24UztYtvQ3qvqljS9CH6G4zxF/SLZ 8/sRpJPvdQps4ywDpoIom0h1QaxCY56A5tBrEE1bfyg5g5YLgJ/gx8RVNUh4SZcLAPYoMMVXY6b jgs2hoKPV+v81zax2iecXT5KqBTpHHcfaRk8URCh8USG1G+ZLwQCVhByLM7yNtQ6QQ5JTW52Ki1 hIsVbfJGb3v9L4um9xdlbPshPX6xZw1JLGqWpnENaGgzI2wYUI5mXDlWHgns2bOKVbQ7gKw2n7h zRY8sWYL+ppLXJElT2/KLpVoGdtz4/G6MGwmyNbcFDaKvw== X-Received: by 2002:a05:701b:230f:b0:1ac:d029:70b5 with SMTP id a92af1059eb24-1acd029740cmr1979637c88.33.1793361147478; Fri, 30 Oct 2026 04:52:27 -0700 (PDT) Received: from [127.0.1.1] ([23.254.208.9]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1ac1abcd6f1sm6437304c88.20.2026.10.30.04.52.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 04:52:27 -0700 (PDT) From: Qiliang Yuan Date: Fri, 30 Oct 2026 07:51:50 -0400 Subject: [PATCH bpf-next v2 05/22] bpf: Expand a backward may_goto to gotol when patches push it out of range X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261030-bpf-verifier-patch-batch-v2-5-55cd43439f7c@gmail.com> References: <20261030-bpf-verifier-patch-batch-v2-0-55cd43439f7c@gmail.com> In-Reply-To: <20261030-bpf-verifier-patch-batch-v2-0-55cd43439f7c@gmail.com> To: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Qiliang Yuan X-Mailer: b4 0.13.0 may_goto_expand() turns may_goto into a conditional jump with a 16-bit offset, or into gotol when the offset of may_goto doesn't fit in 16 bits. bpf_do_misc_fixups() picks the jump from the offset of may_goto in the unpatched program. When the patches queued between a backward may_goto and its target push the offset out of the 16-bit range, the commit fails with -ERANGE, as bpf_patch_insn_data() did before when applying those patches. Add the growth of the patches queued between a backward may_goto and its target to its offset, and use gotol when the result doesn't fit in 16 bits. Signed-off-by: Qiliang Yuan --- kernel/bpf/fixups.c | 38 +++++++++++++++++++++++++++++++------- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c index c9963d8d81356..1d281428acbb3 100644 --- a/kernel/bpf/fixups.c +++ b/kernel/bpf/fixups.c @@ -1968,16 +1968,21 @@ static int add_hidden_subprog(struct bpf_verifier_env *env, struct bpf_insn *pat * may_goto when it is zero, then the tail that updates the count. * Use gotol when the target is too far for 16-bit offset of a conditional jump. */ -static int may_goto_expand(struct bpf_insn *insn_buf, int off, int stack_off, - const struct bpf_insn *tail, int tail_cnt) +/* + * 'off' is the offset of may_goto, 'reach' how far it jumps once the patches + * in between are applied, which decides whether a 16-bit jump will do. + */ +static int may_goto_expand(struct bpf_insn *insn_buf, int off, int reach, + int stack_off, const struct bpf_insn *tail, int tail_cnt) { int cnt = 0; /* Forward jump has to step over the tail */ off = off >= 0 ? off + tail_cnt : off - 1; + reach = reach >= 0 ? reach + tail_cnt : reach - 1; insn_buf[cnt++] = BPF_LDX_MEM(BPF_DW, BPF_REG_AX, BPF_REG_10, stack_off); - if (off == (s16)off) { + if (reach == (s16)reach) { insn_buf[cnt++] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, off); } else { insn_buf[cnt++] = BPF_JMP_IMM(BPF_JNE, BPF_REG_AX, 0, 1); @@ -1987,6 +1992,23 @@ static int may_goto_expand(struct bpf_insn *insn_buf, int off, int stack_off, return cnt + tail_cnt; } +/* The offset of may_goto at 'idx' once the patches queued in front are applied. */ +static int may_goto_off(struct bpf_verifier_env *env, const struct bpf_insn *insn, + u32 idx) +{ + struct bpf_patch_list *pl = &env->patch_list; + u32 tgt = idx + insn->off + 1; + int off = insn->off; + u32 k = pl->cnt; + + if (off >= 0) + return off; + /* all queued patches are in front of idx */ + while (k > 0 && pl->patches[k - 1].off >= tgt) + off -= pl->patches[--k].len - 1; + return off; +} + /* Do various post-verification rewrites in a single program pass. * These rewrites simplify JIT and interpreter implementations. */ @@ -2281,8 +2303,9 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env) * after subtraction, rinse and repeat. */ stack_depth_extra = 16; - cnt = may_goto_expand(insn_buf, insn->off, stack_off_cnt, - tail, ARRAY_SIZE(tail)); + cnt = may_goto_expand(insn_buf, insn->off, + may_goto_off(env, insn, i + delta), + stack_off_cnt, tail, ARRAY_SIZE(tail)); insn = bpf_patch_list_add(env, i + delta, insn_buf, cnt); if (IS_ERR(insn)) @@ -2296,8 +2319,9 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env) }; stack_depth_extra = 8; - cnt = may_goto_expand(insn_buf, insn->off, stack_off, - tail, ARRAY_SIZE(tail)); + cnt = may_goto_expand(insn_buf, insn->off, + may_goto_off(env, insn, i + delta), + stack_off, tail, ARRAY_SIZE(tail)); insn = bpf_patch_list_add(env, i + delta, insn_buf, cnt); if (IS_ERR(insn)) -- 2.43.0