[PATCH bpf-next v2 0/2] bpf: Fix x86 JIT stopping before jumps converge

[Mykyta Yatsenko <mykyta.yatsenko5@gmail.com>]

The x86 JIT stops its sizing passes once two passes give the same image
length. A backward jump can grow while other jumps shrink, so the length
may repeat with jump sizes still changing. The final pass then emits code
of a different size than was sized, hits "bpf_jit: fatal error" and the
program fails to load with -ENOTSUPP.

Patch 1 sizes backward jumps by the insns they jump over, so no insn
grows between passes and a repeated length means nothing moved.
Patch 2 adds a selftest which fails to load without the fix.

This was hit in CI by cgroup_tcp_skb with the unpublished branch
inversion series, whose layout change happened to trigger it.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
Changes in v2:
- Size backward jumps by the insns they jump over instead of checking
  for moved insns, drop the ja -1 special case and the imm8 limit of 123
  (Alexei)
- Start every insn at BPF_MAX_INSN_SIZE, so none grows in the first pass
- Check that the selftest program is JITed
- Link to v1: https://patch.msgid.link/20261021-jit_size_fix-v1-0-b89fd32cafd6@meta.com

---
Mykyta Yatsenko (2):
      bpf: Size backward jumps by the insns they jump over
      selftests/bpf: Test JIT jumps which change at a repeated image length

 arch/x86/net/bpf_jit_comp.c                        | 109 ++++++---------------
 tools/testing/selftests/bpf/prog_tests/jit_insns.c |  59 +++++++++++
 2 files changed, 90 insertions(+), 78 deletions(-)
---
base-commit: 65953903cd7bce4c4392ad6ab629cba78f24644e
change-id: 20261021-jit_size_fix-da316b8d492c

Best regards,
--  
Mykyta Yatsenko <yatsenko@meta.com>