Re: [PATCH v3 bpf-next 07/13] bpf, x86: allow indirect jumps to r8...r15

Eduard Zingerman
2025-09-19T18:38:11Z

On Fri, 2025-09-19 at 11:25 -0700, Eduard Zingerman wrote:

[...]

> > --- a/arch/x86/net/bpf_jit_comp.c
> > +++ b/arch/x86/net/bpf_jit_comp.c
> > @@ -660,24 +660,38 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
> >
> > #define EMIT_LFENCE() EMIT3(0x0F, 0xAE, 0xE8)
> >
> > -static void emit_indirect_jump(u8 **pprog, int reg, u8 *ip)
> > +static void __emit_indirect_jump(u8 **pprog, int reg, bool ereg)
> > {
> > u8 *prog = *pprog;
> >
> > + if (ereg)
> > + EMIT1(0x41);
> > +
> > + EMIT2(0xFF, 0xE0 + reg);
> > +
> > + *pprog = prog;
> > +}
> > +
> > +static void emit_indirect_jump(u8 **pprog, int bpf_reg, u8 *ip)
> > +{

[...]

> > } else {
> > - EMIT2(0xFF, 0xE0 + reg); /* jmp *%\reg */
> > + __emit_indirect_jump(pprog, reg, ereg);
>
> You need to re-read *pprog after __emit_indirect_jump() call
> this is what causes KASAN error I reported in the sibling thread.
> W/o re-reading it the FF E1 emitted above is overwritten to CC E1
> by EMIT1(0xCC) below.
>
> > if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) || IS_ENABLED(CONFIG_MITIGATION_SLS))
> > EMIT1(0xCC); /* int3 */
> > }

Or just move the EMIT1(0xCC) inside __emit_indirect_jump().
It is probably necessary to correctly do mitigations anyway, wdyt?