Re: [PATCH v3 bpf-next 07/13] bpf, x86: allow indirect jumps to r8...r15

[Anton Protopopov <a.s.protopopov@gmail.com>]

On 25/09/19 11:38AM, Eduard Zingerman wrote:
> On Fri, 2025-09-19 at 11:25 -0700, Eduard Zingerman wrote:
> 
> [...]
> 
> > > --- a/arch/x86/net/bpf_jit_comp.c
> > > +++ b/arch/x86/net/bpf_jit_comp.c
> > > @@ -660,24 +660,38 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
> > >
> > >  #define EMIT_LFENCE()	EMIT3(0x0F, 0xAE, 0xE8)
> > >
> > > -static void emit_indirect_jump(u8 **pprog, int reg, u8 *ip)
> > > +static void __emit_indirect_jump(u8 **pprog, int reg, bool ereg)
> > >  {
> > >  	u8 *prog = *pprog;
> > >
> > > +	if (ereg)
> > > +		EMIT1(0x41);
> > > +
> > > +	EMIT2(0xFF, 0xE0 + reg);
> > > +
> > > +	*pprog = prog;
> > > +}
> > > +
> > > +static void emit_indirect_jump(u8 **pprog, int bpf_reg, u8 *ip)
> > > +{
> 
> [...]
> 
> > >  	} else {
> > > -		EMIT2(0xFF, 0xE0 + reg);	/* jmp *%\reg */
> > > +		__emit_indirect_jump(pprog, reg, ereg);
> >
> >                 You need to re-read *pprog after __emit_indirect_jump() call
> >                 this is what causes KASAN error I reported in the sibling thread.
> >                 W/o re-reading it the FF E1 emitted above is overwritten to CC E1
> >                 by EMIT1(0xCC) below.
> >
> > >  		if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) || IS_ENABLED(CONFIG_MITIGATION_SLS))
> > >  			EMIT1(0xCC);		/* int3 */
> > >  	}
> 
> Or just move the EMIT1(0xCC) inside __emit_indirect_jump().
> It is probably necessary to correctly do mitigations anyway, wdyt?

Thanks a lot for bisecting! I think better is to re-read,
as in the other branch we do not emit CC