Re: [PATCH bpf-next v1 1/2] bpf: allow terminal gotox instructions

[Anton Protopopov <a.s.protopopov@gmail.com>]

On 26/08/30 07:31AM, Siddharth Chintamaneni wrote:
> check_subprogs() treats gotox as a direct jump and validates its reserved
> zero offset. When gotox is the final instruction, this produces a
> synthetic successor one instruction past the end of the subprogram and
> rejects an otherwise valid program.
> 
> Skip direct-offset validation for gotox and accept it as a
> non-fallthrough terminal instruction. Its actual targets remain validated
> from the instruction-array jump table during CFG construction.

Thanks, the fix looks correct.

I have comments to the selftest, so expecting v2. When you resend it,
please capitalize "allow" in this commit's title.

Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com>

> Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
> ---
>  kernel/bpf/verifier.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index e036ae20bf6b..44195ec1445d 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -3087,6 +3087,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
>  			subprog[cur_subprog].exit_idx = i;
>  			goto next;
>  		}
> +		if (insn_is_gotox(&insn[i]))
> +			goto next;
>  		off = i + bpf_jmp_offset(&insn[i]) + 1;
>  		if (off < subprog_start || off >= subprog_end) {
>  			verbose(env, "jump out of range from insn %d to %d\n", i, off);
> @@ -3106,7 +3108,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
>  			 */
>  			if (code != (BPF_JMP | BPF_EXIT) &&
>  			    code != (BPF_JMP32 | BPF_JA) &&
> -			    code != (BPF_JMP | BPF_JA)) {
> +			    code != (BPF_JMP | BPF_JA) &&
> +			    !insn_is_gotox(&insn[i])) {
>  				verbose(env, "last insn is not an exit or jmp\n");
>  				bpf_diag_program_structure(
>  					env, i, "subprogram can fall through",
> 
> base-commit: cd35e1b10182c42b4ae31ee49119463b17d8ba7f
> -- 
> 2.43.0
>