Re: [PATCH bpf-next 1/3] bpf: insn array: return proper address for non-zero offsets

Emil Tsalapatis
2026-01-12T17:05:53Z

On Sun Jan 11, 2026 at 10:30 AM EST, Anton Protopopov wrote:
> The map_direct_value_addr() function of the instruction
> array map incorrectly adds offset to the resulting address.
> This is a bug, because later the resolve_pseudo_ldimm64()
> function adds the offset. Fix it. Corresponding selftests
> are added in a consequent commit.
>
> Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")
> Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
> kernel/bpf/bpf_insn_array.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/bpf_insn_array.c b/kernel/bpf/bpf_insn_array.c
> index c96630cb75bf..37b43102953e 100644
> --- a/kernel/bpf/bpf_insn_array.c
> +++ b/kernel/bpf/bpf_insn_array.c
> @@ -126,7 +126,7 @@ static int insn_array_map_direct_value_addr(const struct bpf_map *map, u64 *imm,
> return -EINVAL;
>
> /* from BPF's point of view, this map is a jump table */
> - *imm = (unsigned long)insn_array->ips + off;
> + *imm = (unsigned long)insn_array->ips;
>
> return 0;
> }