Re: [PATCH bpf-next v1 1/2] bpf: Reject invalid LDSX instruction in disassembly

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 8/20/26 10:20 AM, Kumar Kartikeya Dwivedi wrote:
> The signed-load mnemonic table has entries for byte, half-word, and word
> loads because BPF_MEMSX does not support double-word loads. A BPF_MEMSX
> | BPF_DW instruction nevertheless selects index 3, past the end of this
> table.
>
> Program Structure diagnostics can disassemble a malformed instruction
> before check_and_resolve_insns() rejects its opcode. Placing the invalid
> signed double-word load at the end of a program therefore triggers an
> out-of-bounds access while reporting subprogram fallthrough.
>
> Treat signed double-word loads as invalid in the disassembler and use
> the existing BUG_ldx fallback instead.
>
> Fixes: a8f427835394 ("bpf: Report Program Structure CFG errors")
> Reported-by: syzbot+3544d9b2a9206be8ba37@syzkaller.appspotmail.com
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Sign-extending a 64-bit load is truly meaningless for printing

and this opcode is already treated as invalid in bpf_opcode_in_insntable()


> ---
>   kernel/bpf/disasm.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c
> index 50b3ca5149a0..b1a3fbe3fda5 100644
> --- a/kernel/bpf/disasm.c
> +++ b/kernel/bpf/disasm.c
> @@ -295,7 +295,8 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs,
>   			verbose(cbs->private_data, "BUG_st_%02x", insn->code);
>   		}
>   	} else if (class == BPF_LDX) {
> -		if (BPF_MODE(insn->code) != BPF_MEM && BPF_MODE(insn->code) != BPF_MEMSX) {
> +		if ((BPF_MODE(insn->code) != BPF_MEM && BPF_MODE(insn->code) != BPF_MEMSX) ||
> +		    (BPF_MODE(insn->code) == BPF_MEMSX && BPF_SIZE(insn->code) == BPF_DW)) {
>   			verbose(cbs->private_data, "BUG_ldx_%02x", insn->code);
>   			return;
>   		}