Re: [PATCH v3 bpf-next 07/13] bpf, x86: allow indirect jumps to r8...r15

Anton Protopopov
2025-09-19T19:19:12Z

On 25/09/19 11:38AM, Eduard Zingerman wrote:
> On Fri, 2025-09-19 at 11:25 -0700, Eduard Zingerman wrote:
>
> [...]
>
> > > --- a/arch/x86/net/bpf_jit_comp.c
> > > +++ b/arch/x86/net/bpf_jit_comp.c
> > > @@ -660,24 +660,38 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
> > >
> > > #define EMIT_LFENCE() EMIT3(0x0F, 0xAE, 0xE8)
> > >
> > > -static void emit_indirect_jump(u8 **pprog, int reg, u8 *ip)
> > > +static void __emit_indirect_jump(u8 **pprog, int reg, bool ereg)
> > > {
> > > u8 *prog = *pprog;
> > >
> > > + if (ereg)
> > > + EMIT1(0x41);
> > > +
> > > + EMIT2(0xFF, 0xE0 + reg);
> > > +
> > > + *pprog = prog;
> > > +}
> > > +
> > > +static void emit_indirect_jump(u8 **pprog, int bpf_reg, u8 *ip)
> > > +{
>
> [...]
>
> > > } else {
> > > - EMIT2(0xFF, 0xE0 + reg); /* jmp *%\reg */
> > > + __emit_indirect_jump(pprog, reg, ereg);
> >
> > You need to re-read *pprog after __emit_indirect_jump() call
> > this is what causes KASAN error I reported in the sibling thread.
> > W/o re-reading it the FF E1 emitted above is overwritten to CC E1
> > by EMIT1(0xCC) below.
> >
> > > if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) || IS_ENABLED(CONFIG_MITIGATION_SLS))
> > > EMIT1(0xCC); /* int3 */
> > > }
>
> Or just move the EMIT1(0xCC) inside __emit_indirect_jump().
> It is probably necessary to correctly do mitigations anyway, wdyt?

Thanks a lot for bisecting! I think better is to re-read,
as in the other branch we do not emit CC