[PATCH bpf-next v1 0/2] Reject invalid LDSX instruction in disassembler

[PATCH bpf-next v1 0/2] Reject invalid LDSX instruction in disassembler

[Kumar Kartikeya Dwivedi]

Reject invalid LDSX insn encoding in print_bpf_insn. This was reported
by syzbot in [0]. See commit logs for details.

  [0]: https://lore.kernel.org/bpf/6a86596a.ae6ddae5.3da009.0015.GAE@google.com

Kumar Kartikeya Dwivedi (2):
  bpf: Reject invalid LDSX instruction in disassembly
  selftests/bpf: Test invalid DW LDSX diagnostics

 kernel/bpf/disasm.c                              |  3 ++-
 tools/testing/selftests/bpf/progs/verifier_cfg.c | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)


base-commit: f79066c784022fda83f5936559a1af414e41b603
-- 
2.53.0

[PATCH bpf-next v1 1/2] bpf: Reject invalid LDSX instruction in disassembly

[Kumar Kartikeya Dwivedi]

The signed-load mnemonic table has entries for byte, half-word, and word
loads because BPF_MEMSX does not support double-word loads. A BPF_MEMSX
| BPF_DW instruction nevertheless selects index 3, past the end of this
table.

Program Structure diagnostics can disassemble a malformed instruction
before check_and_resolve_insns() rejects its opcode. Placing the invalid
signed double-word load at the end of a program therefore triggers an
out-of-bounds access while reporting subprogram fallthrough.

Treat signed double-word loads as invalid in the disassembler and use
the existing BUG_ldx fallback instead.

Fixes: a8f427835394 ("bpf: Report Program Structure CFG errors")
Reported-by: syzbot+3544d9b2a9206be8ba37@syzkaller.appspotmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 kernel/bpf/disasm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c
index 50b3ca5149a0..b1a3fbe3fda5 100644
--- a/kernel/bpf/disasm.c
+++ b/kernel/bpf/disasm.c
@@ -295,7 +295,8 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs,
 			verbose(cbs->private_data, "BUG_st_%02x", insn->code);
 		}
 	} else if (class == BPF_LDX) {
-		if (BPF_MODE(insn->code) != BPF_MEM && BPF_MODE(insn->code) != BPF_MEMSX) {
+		if ((BPF_MODE(insn->code) != BPF_MEM && BPF_MODE(insn->code) != BPF_MEMSX) ||
+		    (BPF_MODE(insn->code) == BPF_MEMSX && BPF_SIZE(insn->code) == BPF_DW)) {
 			verbose(cbs->private_data, "BUG_ldx_%02x", insn->code);
 			return;
 		}
-- 
2.53.0

[PATCH bpf-next v1 2/2] selftests/bpf: Test invalid DW LDSX diagnostics

[Kumar Kartikeya Dwivedi]

An invalid BPF_MEMSX | BPF_DW instruction can reach Program Structure
diagnostics before opcode validation when placed at the end of a subprogram.
Exercise this path and require the disassembler fallback so table bounds
regressions are caught.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 tools/testing/selftests/bpf/progs/verifier_cfg.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_cfg.c b/tools/testing/selftests/bpf/progs/verifier_cfg.c
index c1f55e1d80a4..3c3bb03e8217 100644
--- a/tools/testing/selftests/bpf/progs/verifier_cfg.c
+++ b/tools/testing/selftests/bpf/progs/verifier_cfg.c
@@ -3,6 +3,7 @@
 
 #include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>
+#include "../../../include/linux/filter.h"
 #include "bpf_misc.h"
 
 SEC("socket")
@@ -55,6 +56,19 @@ __naked void out_of_range_jump2(void)
 "	::: __clobber_all);
 }
 
+SEC("socket")
+__description("invalid DW LDSX instruction in diagnostics")
+__failure __msg("BUG_ldx_99")
+__log_level(2)
+__naked void invalid_dw_ldsx(void)
+{
+	asm volatile ("					\
+	.8byte %[ldsx_dw];				\
+"	:
+	: __imm_insn(ldsx_dw, BPF_RAW_INSN(BPF_LDX | BPF_MEMSX | BPF_DW, BPF_REG_0, BPF_REG_0, 0, 0))
+	: __clobber_all);
+}
+
 SEC("socket")
 __description("loop (back-edge)")
 __failure __msg("unreachable insn 1")
-- 
2.53.0

Re: [PATCH bpf-next v1 1/2] bpf: Reject invalid LDSX instruction in disassembly

[Jiayuan Chen]

On 8/20/26 10:20 AM, Kumar Kartikeya Dwivedi wrote:
> The signed-load mnemonic table has entries for byte, half-word, and word
> loads because BPF_MEMSX does not support double-word loads. A BPF_MEMSX
> | BPF_DW instruction nevertheless selects index 3, past the end of this
> table.
>
> Program Structure diagnostics can disassemble a malformed instruction
> before check_and_resolve_insns() rejects its opcode. Placing the invalid
> signed double-word load at the end of a program therefore triggers an
> out-of-bounds access while reporting subprogram fallthrough.
>
> Treat signed double-word loads as invalid in the disassembler and use
> the existing BUG_ldx fallback instead.
>
> Fixes: a8f427835394 ("bpf: Report Program Structure CFG errors")
> Reported-by: syzbot+3544d9b2a9206be8ba37@syzkaller.appspotmail.com
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Sign-extending a 64-bit load is truly meaningless for printing

and this opcode is already treated as invalid in bpf_opcode_in_insntable()


> ---
>   kernel/bpf/disasm.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c
> index 50b3ca5149a0..b1a3fbe3fda5 100644
> --- a/kernel/bpf/disasm.c
> +++ b/kernel/bpf/disasm.c
> @@ -295,7 +295,8 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs,
>   			verbose(cbs->private_data, "BUG_st_%02x", insn->code);
>   		}
>   	} else if (class == BPF_LDX) {
> -		if (BPF_MODE(insn->code) != BPF_MEM && BPF_MODE(insn->code) != BPF_MEMSX) {
> +		if ((BPF_MODE(insn->code) != BPF_MEM && BPF_MODE(insn->code) != BPF_MEMSX) ||
> +		    (BPF_MODE(insn->code) == BPF_MEMSX && BPF_SIZE(insn->code) == BPF_DW)) {
>   			verbose(cbs->private_data, "BUG_ldx_%02x", insn->code);
>   			return;
>   		}