Re: [PATCH v2 bpf-next 1/2] bpf: Do not ignore offsets for loads from insn_arrays

[Anton Protopopov <a.s.protopopov@gmail.com>]

On 26/04/02 12:00PM, Alexei Starovoitov wrote:
> On Thu, Apr 2, 2026 at 11:38 AM Anton Protopopov
> <a.s.protopopov@gmail.com> wrote:
> >
> > When a pointer to PTR_TO_INSN is dereferenced it is possible to
> > specify an offset inside the load instruction. This is a bug,
> > because while the verifier ignores the field, JITs are not.
> > So, patch the verifier to not ignore this field.
> 
> This is too terse to understand.
> In 2nd patch you're saying:
> 
>    r1 = &map + offset1
>    r1 += offset2
>    r1 = *(r1 + offset3)
>    gotox r1
> 
> Here offset3 is, normally, equal to zero; but this is not guaranteed.
> 
> What is this 'offset3'? Where did it come from?

The offset3 is the .off field of the BPF_LDX_MEM instruction.
The BPF assembler will correctly work with non-zero offsets:

    r1 = &map;
    r1 = *(r1 + offset)

> What do you mean JIT handles it?

JIT will issue a memory load with this offset,
but verifier will ignore it (before this patch).

> can llvm ever generate such code?
> if not, reject it early ?

LLVM can generate code with non-zero offset in BPF_LDX_MEM,
say, if one jumps to a structure field, like in `goto *p->j`
(see CurDAG->isBaseWithConstantOffset(Addr) check in
BPFDAGToDAGISel::SelectAddr). Realistically, for now
this doesn't make too much sense (looks like switches and goto *jt[i]
will not emit such code), but one future use-case might be
smth like a function pointer in a struct.