From: sashiko-bot@kernel.org
To: "Daniel Borkmann" <daniel@iogearbox.net>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next 14/18] bpf, x86: Multiply by 3, 5 and 9 with lea
Date: Tue, 13 Oct 2026 17:58:01 +0000 [thread overview]
Message-ID: <sashiko-outbox-170282@kernel.org> (raw)
In-Reply-To: <20261013171230.523677-15-daniel@iogearbox.net>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] bpf, x86: R12 ignored as SIB index, bypassing arena base
--
commit 67afba40c1efdd0d3dc72afceed029446b9b3578
Author: Daniel Borkmann <daniel@iogearbox.net>
bpf, x86: Multiply by 3, 5 and 9 with lea
The commit converts BPF multiplication by 3, 5, and 9 into x86 lea
instructions. It adds a scale parameter to emit_insn_suffix_SIB to
support the scale factor in the SIB byte.
> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index 4e9c6bbe93d0c..d1c22ae90fcc6 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
> @@ -1163,17 +1163,22 @@ static void emit_insn_suffix(u8 **pprog, u32 ptr_reg, u32 val_reg, int off)
> *pprog = prog;
> }
>
> -static void emit_insn_suffix_SIB(u8 **pprog, u32 ptr_reg, u32 val_reg, u32 index_reg, int off)
> +/*
> + * Emit the suffix for addressing *(ptr_reg + (index_reg << scale) + off)
> + * and val_reg, with a SIB byte
> + */
> +static void emit_insn_suffix_SIB(u8 **pprog, u32 ptr_reg, u32 val_reg, u32 index_reg, int off,
> + u8 scale)
> {
> + u8 sib = (scale << 6) | add_2reg(0, ptr_reg, index_reg);
^^^^
[Severity: Critical]
Does this code silently drop the arena base pointer if index_reg is
X86_REG_R12?
When index_reg is X86_REG_R12 (which has a value of 4), the SIB index field
becomes 100b. On x86-64, an index of 100b is interpreted as 'no index
register', so the CPU completely ignores the R12 base.
For BPF programs utilizing arena memory (e.g., via BPF_PROBE_MEM32),
functions like emit_ldx_r12(), emit_stx_r12(), and emit_st_r12() explicitly
pass X86_REG_R12 as the index register to emit_insn_suffix_SIB().
Because the R12 index is ignored, the kernel will incorrectly dereference
the user-provided 32-bit offset directly instead of adding it to the arena
base. This could allow a BPF program to read and write arbitrary user-space
memory, bypassing arena bounds.
> u8 *prog = *pprog;
>
> if (!off && !base_needs_disp(ptr_reg)) {
> - EMIT2(add_2reg(0x04, BPF_REG_0, val_reg),
> - add_2reg(0, ptr_reg, index_reg) /* SIB */);
> + EMIT2(add_2reg(0x04, BPF_REG_0, val_reg), sib);
> } else if (is_imm8(off)) {
> - EMIT3(add_2reg(0x44, BPF_REG_0, val_reg), add_2reg(0, ptr_reg, index_reg) /* SIB */, off);
> + EMIT3(add_2reg(0x44, BPF_REG_0, val_reg), sib, off);
> } else {
> - EMIT2_off32(add_2reg(0x84, BPF_REG_0, val_reg), add_2reg(0, ptr_reg, index_reg) /* SIB */, off);
> + EMIT2_off32(add_2reg(0x84, BPF_REG_0, val_reg), sib, off);
> }
> *pprog = prog;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261013171230.523677-1-daniel@iogearbox.net?part=14
next prev parent reply other threads:[~2026-10-13 17:58 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-13 17:12 [PATCH bpf-next 00/18] bpf: Various x86-64 BPF JIT improvements Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 01/18] bpf, x86: Drop redundant REX prefixes from zero and sign extensions Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 02/18] bpf, x86: Omit the displacement byte for zero offsets Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 03/18] bpf, x86: Shorten the stack adjusts and the tail call counter loads Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 04/18] bpf, x86: Use shorter test and cmp encodings for immediates Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 05/18] bpf, x86: Compare against 0, 127 and -128 with the adjusted condition Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 06/18] bpf, x86: Use movzx for byte and word masks and a not for xor with -1 Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 07/18] bpf, x86: Consolidate the ALU, shift and neg encodings into helpers Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 08/18] bpf, x86: Use shorter and faster forms for some ALU immediates Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 09/18] bpf, x86: Swap 16-bit values with bswap and shr, not ror and movzx Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 10/18] bpf, x86: Use BMI2 shifts also when the count is in rcx Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 11/18] bpf, x86: Fold the PROBE_MEM address computation into a lea Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 12/18] bpf, x86: Compare the PROBE_MEM address range with a shift Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 13/18] bpf, x86: Divide by constants via multiplication with a magic number Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 14/18] bpf, x86: Multiply by 3, 5 and 9 with lea Daniel Borkmann
2026-10-13 17:58 ` sashiko-bot [this message]
2026-10-13 19:15 ` Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 15/18] bpf, x86: Use emit_sub_rsp() for the trampoline stack Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 16/18] bpf, x86: Shorten the cast to a user address Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 17/18] selftests/bpf: Add JIT instruction tests Daniel Borkmann
2026-10-13 18:46 ` bot+bpf-ci
2026-10-13 17:12 ` [PATCH bpf-next 18/18] selftests/bpf: Remove the old test_bpf module Daniel Borkmann
2026-10-13 18:22 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-170282@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.