Re: [PATCH bpf-next 07/17] bpf, x86: Add JIT support for callx

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Tue, Sep 22, 2026 at 01:27 AM sashiko-bot@kernel.org <sashiko-bot@kernel.org> wrote:
>> +	} else {
>> +		__emit_indirect_call(&prog, reg, ereg);
>
> [Severity: High]
> Does emit_indirect_call() emit raw indirect branches without KCFI hash
> validation?
>
> If KCFI is active, it seems __emit_indirect_call() emits a bare indirect
> branch instruction without the preceding caller-side hash check.
>
> If an attacker were able to overwrite a spilled subprogram pointer, could they
> trigger this execution path to jump to an arbitrary kernel address and bypass
> KCFI protections?

Not a bug. The kCFI hash check is what the compiler emits in front of
indirect calls in C code. JIT emits the callee side only, see
emit_kcfi(), so that C callers of bpf_func and of callbacks pass their
check. None of the indirect branches emitted by JIT check the hash:
tail call, gotox, trampoline. callx is no different. The target is
PTR_TO_FUNC with zero offset. The verifier guarantees that it's the
entry of a static subprog of this prog.
Whoever can overwrite a spilled pointer on bpf stack can overwrite
the return address next to it.

[...]
>> +	return cfi_mode != CFI_FINEIBT;
>
> [Severity: High]
> Can bpf_jit_supports_callx() incorrectly allow indirect calls to be compiled
> when KCFI is enabled?

No. Same as above. With CFI_KCFI bpf_func points to ENDBR after the
hash, so 'call *reg' into it works. With FineIBT that ENDBR is
poisoned and the call would fault. That's the only reason FineIBT is
excluded.