Re: [PATCH v3 bpf-next 00/13] BPF indirect jumps

Eduard Zingerman
2025-09-19T18:03:34Z

On Fri, 2025-09-19 at 10:27 -0700, Eduard Zingerman wrote:
> On Thu, 2025-09-18 at 23:46 -0700, Eduard Zingerman wrote:
> > On Thu, 2025-09-18 at 09:38 +0000, Anton Protopopov wrote:
> > > This patchset implements a new type of map, instruction set, and uses
> > > it to build support for indirect branches in BPF (on x86). (The same
> > > map will be later used to provide support for indirect calls and static
> > > keys.) See [1], [2] for more context.
> >
> > With this patch-set on top of the bpf-next at commit [1],
> > I get a KASAN bug report [2] when running `./test_progs -t tailcalls`.
> > Does not happen w/o this series applied.
> > Kernel is compiled with gcc 15.2.1, selftests are compiled with clang
> > 20.1.8 (w/o gotox support).
> >
> > [1] 3547a61ee2fe ("Merge branch 'update-kf_rcu_protected'")
> > [2] https://gist.github.com/eddyz87/8f82545db32223d8a80d2ca69a47bbc2
> >
> > [...]
>
> Bisect points to patch #7 "bpf, x86: allow indirect jumps to r8...r15".

And this does not happen on my other machine.
I inserted a few printks, on the good machine #3 is printed,
on the bad machine #4 is printed:

static void emit_indirect_jump(u8 **pprog, int bpf_reg, u8 *ip)
{
u8 *prog = *pprog;
int reg = reg2hex[bpf_reg];
bool ereg = is_ereg(bpf_reg);

if (cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) {
+ printk("emit_indirect_jump #1\n");
OPTIMIZER_HIDE_VAR(reg);
emit_jump(&prog, its_static_thunk(reg), ip);
} else if (cpu_feature_enabled(X86_FEATURE_RETPOLINE_LFENCE)) {
+ printk("emit_indirect_jump #2\n");
EMIT_LFENCE();
__emit_indirect_jump(pprog, reg, ereg);
} else if (cpu_feature_enabled(X86_FEATURE_RETPOLINE)) {
+ printk("emit_indirect_jump #3\n");
OPTIMIZER_HIDE_VAR(reg);
if (cpu_feature_enabled(X86_FEATURE_CALL_DEPTH))
emit_jump(&prog, &__x86_indirect_jump_thunk_array[reg + 8*ereg], ip);
else
emit_jump(&prog, &__x86_indirect_thunk_array[reg + 8*ereg], ip);
} else {
+ printk("emit_indirect_jump #4\n");
__emit_indirect_jump(pprog, reg, ereg);
if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) || IS_ENABLED(CONFIG_MITIGATION_SLS))
EMIT1(0xCC); /* int3 */
}

*pprog = prog;
}