Re: [PATCH v10 bpf-next 06/11] bpf, x86: add support for indirect jumps

[Anton Protopopov <a.s.protopopov@gmail.com>]

On 25/11/02 09:20PM, bot+bpf-ci@kernel.org wrote:
> 
> ```
> commit 6cb8001495faae09541d55309638b3c1920bae06
> Author: Anton Protopopov <a.s.protopopov@gmail.com>
> 
> bpf, x86: add support for indirect jumps
> 
> This patch adds support for indirect jumps in BPF through a new
> BPF_JMP|BPF_X|BPF_JA instruction. It introduces the PTR_TO_INSN register
> type for instruction pointers loaded from INSN_ARRAY maps, along with
> verifier support for tracking jump tables and x86 JIT implementation.
> 
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> 
> [ ... ]
> 
> > @@ -21374,6 +21374,28 @@ static int bpf_adj_linfo_after_remove(struct bpf_verifier_env *env, u32 off,
> >  	return 0;
> >  }
> >
> > +/*
> > + * Clean up dynamically allocated fields of aux data for instructions [start, ...]
> > + */
> > +static void clear_insn_aux_data(struct bpf_verifier_env *env, int start, int len)
> > +{
> > +	struct bpf_insn_aux_data *aux_data = env->insn_aux_data;
> > +	struct bpf_insn *insns = env->prog->insnsi;
> > +	int end = start + len;
> > +	int i;
> > +
> > +	for (i = start; i < end; i++) {
> > +		if (insn_is_gotox(&insns[i])) {
> > +			kvfree(aux_data[i].jt);
> > +			aux_data[i].jt = NULL;
> > +		}
> > +
> > +		if (bpf_is_ldimm64(&insns[i]))
> > +			i++;
> > +	}
> > +}
> > +
> >  static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt)
> >  {
> >  	struct bpf_insn_aux_data *aux_data = env->insn_aux_data;
> > @@ -21393,6 +21415,8 @@ static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt
> >
> >  	adjust_insn_arrays_after_remove(env, off, cnt);
> >
> > +	clear_insn_aux_data(env, off, cnt);
> > +
> >  	memmove(aux_data + off,	aux_data + off + cnt,
> >  		sizeof(*aux_data) * (orig_prog_len - off - cnt));
> 
> Can clear_insn_aux_data() correctly identify which aux_data entries need
> cleanup when it's called after bpf_remove_insns()? After instructions are
> removed, the insns[] array has been modified - insns[off] now contains what
> was previously insns[off+cnt]. But aux_data hasn't been shifted yet, so
> clear_insn_aux_data() checks the wrong instructions when deciding which
> aux_data entries to free.
> 
> For example, if instructions [1,2] are removed where insn 2 is a gotox:
> - bpf_remove_insns() removes insns[1] and insns[2], shifts later insns down
> - insns[1] now contains what was insns[3]
> - clear_insn_aux_data() checks insn_is_gotox(&insns[1]) (now insn 3!)
> - It might free aux_data[1].jt if insn 3 is a gotox, even though insn 3
>   isn't being removed
> - It never checks the original insns[2] which was the actual gotox that
>   needed cleanup
> 
> Should clear_insn_aux_data() be called before bpf_remove_insns() instead?

Looks plausible. I will move it upper and add a comment on the call order.

> 
> ```
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> In-Reply-To-Subject: `bpf, x86: add support for indirect jumps`
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19018051915