[PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions

[PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions

[Siddharth Chintamaneni]

check_subprogs() treats gotox as a direct jump and validates its reserved
zero offset. When gotox is the final instruction, this produces a
synthetic successor one instruction past the end of the subprogram and
rejects an otherwise valid program.

Skip direct-offset validation for gotox and accept it as a
non-fallthrough terminal instruction. Its actual targets remain validated
from the instruction-array jump table during CFG construction.

Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com>
---
 kernel/bpf/verifier.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e036ae20bf6b..44195ec1445d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3087,6 +3087,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
 			subprog[cur_subprog].exit_idx = i;
 			goto next;
 		}
+		if (insn_is_gotox(&insn[i]))
+			goto next;
 		off = i + bpf_jmp_offset(&insn[i]) + 1;
 		if (off < subprog_start || off >= subprog_end) {
 			verbose(env, "jump out of range from insn %d to %d\n", i, off);
@@ -3106,7 +3108,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
 			 */
 			if (code != (BPF_JMP | BPF_EXIT) &&
 			    code != (BPF_JMP32 | BPF_JA) &&
-			    code != (BPF_JMP | BPF_JA)) {
+			    code != (BPF_JMP | BPF_JA) &&
+			    !insn_is_gotox(&insn[i])) {
 				verbose(env, "last insn is not an exit or jmp\n");
 				bpf_diag_program_structure(
 					env, i, "subprogram can fall through",

base-commit: cd35e1b10182c42b4ae31ee49119463b17d8ba7f
-- 
2.43.0

[PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions

[Siddharth Chintamaneni]

Add tests that place gotox at the end of the main program and a
subprogram, with each jump-table target preceding the gotox instruction.
This tests gotox as a valid non-fallthrough terminal instruction.

Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
---
 .../selftests/bpf/progs/verifier_gotox.c      | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
index 5b18c9a27717..89067ab7baaa 100644
--- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
+++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
@@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg,      BPF_REG_1, 0, 0, __fa
 DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
 DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
 
+SEC("socket")
+__success __retval(0)
+__naked void jump_table_terminal_gotox(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:							\
+	.quad ret0_%= - socket;					\
+	.size jt0_%=, 8;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	goto end_%=;						\
+ret0_%=:							\
+	r0 = 0;							\
+	exit;							\
+end_%=:							\
+	.8byte %[gotox_r0];					\
+"	:
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
+					    BPF_REG_0, 0, 0, 0))
+	: __clobber_all);
+}
+
+static __naked __noinline __used
+void terminal_gotox_subprog(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:							\
+	.quad ret0_%= - .text;					\
+	.size jt0_%=, 8;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	goto end_%=;						\
+ret0_%=:							\
+	r0 = 0;							\
+	exit;							\
+end_%=:							\
+	.8byte %[gotox_r0];					\
+"	:
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
+					    BPF_REG_0, 0, 0, 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__success __retval(0)
+__naked void jump_table_terminal_gotox_subprog(void)
+{
+	asm volatile ("						\
+	call terminal_gotox_subprog;				\
+	exit;							\
+"	::: __clobber_all);
+}
+
 /*
  * Gotox is forbidden when there is no jump table loaded
  * which points to the sub-function where the gotox is used
-- 
2.43.0

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3043 bytes --]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> index 5b18c9a27717b..89067ab7baaa4 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> @@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg,      BPF_REG_1, 0, 0, __fa
>  DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
>  DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
>
> +SEC("socket")
> +__success __retval(0)
> +__naked void jump_table_terminal_gotox(void)
> +{
> +	asm volatile ("						\
> +	.pushsection .jumptables,\"\",@progbits;		\
> +jt0_%=:							\
> +	.quad ret0_%= - socket;					\
> +	.size jt0_%=, 8;					\
> +	.global jt0_%=;						\
> +	.popsection;						\
> +								\
> +	r0 = jt0_%= ll;						\
> +	r0 = *(u64 *)(r0 + 0);					\
> +	goto end_%=;						\
> +ret0_%=:							\
> +	r0 = 0;							\
> +	exit;							\
> +end_%=:							\
> +	.8byte %[gotox_r0];					\
> +"	:
> +	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> +					    BPF_REG_0, 0, 0, 0))
> +	: __clobber_all);
> +}
> +
> +static __naked __noinline __used
> +void terminal_gotox_subprog(void)
> +{
> +	asm volatile ("						\
> +	.pushsection .jumptables,\"\",@progbits;		\
> +jt0_%=:							\
> +	.quad ret0_%= - .text;					\
> +	.size jt0_%=, 8;					\
> +	.global jt0_%=;						\
> +	.popsection;						\
> +								\
> +	r0 = jt0_%= ll;						\
> +	r0 = *(u64 *)(r0 + 0);					\
> +	goto end_%=;						\
> +ret0_%=:							\
> +	r0 = 0;							\
> +	exit;							\
> +end_%=:							\
> +	.8byte %[gotox_r0];					\
> +"	:
> +	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> +					    BPF_REG_0, 0, 0, 0))
> +	: __clobber_all);
> +}

This isn't a bug, but terminal_gotox_subprog() differs from
jump_table_terminal_gotox() above only in the jump-table base symbol
(- .text vs - socket). The file elsewhere factors similar shapes into
macros (DEFINE_SIMPLE_JUMP_TABLE_PROG, DEFINE_INVALID_SIZE_PROG,
DEFINE_JUMP_TABLE_USE_REG). Would a small macro parameterised on the
base read better here?

Also, since libbpf appends the only called subprogram last, this
subprogram's gotox ends up as the final instruction of the whole loaded
program. Would adding a further subprogram after it give coverage of the
fall-through-into-the-next-subprog case that the relaxed check in
check_subprogs() guards?

> +
> +SEC("socket")
> +__success __retval(0)
> +__naked void jump_table_terminal_gotox_subprog(void)
> +{
> +	asm volatile ("						\
> +	call terminal_gotox_subprog;				\
> +	exit;							\
> +"	::: __clobber_all);
> +}

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions

[Anton Protopopov]

On 26/08/31 11:26PM, bot+bpf-ci@kernel.org wrote:
> > diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > index 5b18c9a27717b..89067ab7baaa4 100644
> > --- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > +++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > @@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg,      BPF_REG_1, 0, 0, __fa
> >  DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> >  DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> >
> > +SEC("socket")
> > +__success __retval(0)
> > +__naked void jump_table_terminal_gotox(void)
> > +{
> > +	asm volatile ("						\
> > +	.pushsection .jumptables,\"\",@progbits;		\
> > +jt0_%=:							\
> > +	.quad ret0_%= - socket;					\
> > +	.size jt0_%=, 8;					\
> > +	.global jt0_%=;						\
> > +	.popsection;						\
> > +								\
> > +	r0 = jt0_%= ll;						\
> > +	r0 = *(u64 *)(r0 + 0);					\
> > +	goto end_%=;						\
> > +ret0_%=:							\
> > +	r0 = 0;							\
> > +	exit;							\
> > +end_%=:							\
> > +	.8byte %[gotox_r0];					\
> > +"	:
> > +	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > +					    BPF_REG_0, 0, 0, 0))
> > +	: __clobber_all);
> > +}
> > +
> > +static __naked __noinline __used
> > +void terminal_gotox_subprog(void)
> > +{
> > +	asm volatile ("						\
> > +	.pushsection .jumptables,\"\",@progbits;		\
> > +jt0_%=:							\
> > +	.quad ret0_%= - .text;					\
> > +	.size jt0_%=, 8;					\
> > +	.global jt0_%=;						\
> > +	.popsection;						\
> > +								\
> > +	r0 = jt0_%= ll;						\
> > +	r0 = *(u64 *)(r0 + 0);					\
> > +	goto end_%=;						\
> > +ret0_%=:							\
> > +	r0 = 0;							\
> > +	exit;							\
> > +end_%=:							\
> > +	.8byte %[gotox_r0];					\
> > +"	:
> > +	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > +					    BPF_REG_0, 0, 0, 0))
> > +	: __clobber_all);
> > +}
> 
> This isn't a bug, but terminal_gotox_subprog() differs from
> jump_table_terminal_gotox() above only in the jump-table base symbol
> (- .text vs - socket). The file elsewhere factors similar shapes into
> macros (DEFINE_SIMPLE_JUMP_TABLE_PROG, DEFINE_INVALID_SIZE_PROG,
> DEFINE_JUMP_TABLE_USE_REG). Would a small macro parameterised on the
> base read better here?
> 
> Also, since libbpf appends the only called subprogram last, this
> subprogram's gotox ends up as the final instruction of the whole loaded
> program. Would adding a further subprogram after it give coverage of the
> fall-through-into-the-next-subprog case that the relaxed check in
> check_subprogs() guards?

If you add a macro as robot suggested, then the
jump_table_terminal_gotox_subprog() below can call two subprogs
(same, with different names).

Otherwise, looks good to me!

> > +
> > +SEC("socket")
> > +__success __retval(0)
> > +__naked void jump_table_terminal_gotox_subprog(void)
> > +{
> > +	asm volatile ("						\
> > +	call terminal_gotox_subprog;				\
> > +	exit;							\
> > +"	::: __clobber_all);
> > +}
> 
> [ ... ]
> 
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions

[Siddharth Chintamaneni]

On Tue, 1 Sept 2026 at 06:47, Anton Protopopov <a.s.protopopov@gmail.com> wrote:
>
> On 26/08/31 11:26PM, bot+bpf-ci@kernel.org wrote:
> > > diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > > index 5b18c9a27717b..89067ab7baaa4 100644
> > > --- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > > +++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > > @@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg,      BPF_REG_1, 0, 0, __fa
> > >  DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> > >  DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> > >
> > > +SEC("socket")
> > > +__success __retval(0)
> > > +__naked void jump_table_terminal_gotox(void)
> > > +{
> > > +   asm volatile ("                                         \
> > > +   .pushsection .jumptables,\"\",@progbits;                \
> > > +jt0_%=:                                                    \
> > > +   .quad ret0_%= - socket;                                 \
> > > +   .size jt0_%=, 8;                                        \
> > > +   .global jt0_%=;                                         \
> > > +   .popsection;                                            \
> > > +                                                           \
> > > +   r0 = jt0_%= ll;                                         \
> > > +   r0 = *(u64 *)(r0 + 0);                                  \
> > > +   goto end_%=;                                            \
> > > +ret0_%=:                                                   \
> > > +   r0 = 0;                                                 \
> > > +   exit;                                                   \
> > > +end_%=:                                                    \
> > > +   .8byte %[gotox_r0];                                     \
> > > +"  :
> > > +   : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > > +                                       BPF_REG_0, 0, 0, 0))
> > > +   : __clobber_all);
> > > +}
> > > +
> > > +static __naked __noinline __used
> > > +void terminal_gotox_subprog(void)
> > > +{
> > > +   asm volatile ("                                         \
> > > +   .pushsection .jumptables,\"\",@progbits;                \
> > > +jt0_%=:                                                    \
> > > +   .quad ret0_%= - .text;                                  \
> > > +   .size jt0_%=, 8;                                        \
> > > +   .global jt0_%=;                                         \
> > > +   .popsection;                                            \
> > > +                                                           \
> > > +   r0 = jt0_%= ll;                                         \
> > > +   r0 = *(u64 *)(r0 + 0);                                  \
> > > +   goto end_%=;                                            \
> > > +ret0_%=:                                                   \
> > > +   r0 = 0;                                                 \
> > > +   exit;                                                   \
> > > +end_%=:                                                    \
> > > +   .8byte %[gotox_r0];                                     \
> > > +"  :
> > > +   : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > > +                                       BPF_REG_0, 0, 0, 0))
> > > +   : __clobber_all);
> > > +}
> >
> > This isn't a bug, but terminal_gotox_subprog() differs from
> > jump_table_terminal_gotox() above only in the jump-table base symbol
> > (- .text vs - socket). The file elsewhere factors similar shapes into
> > macros (DEFINE_SIMPLE_JUMP_TABLE_PROG, DEFINE_INVALID_SIZE_PROG,
> > DEFINE_JUMP_TABLE_USE_REG). Would a small macro parameterised on the
> > base read better here?
> >
> > Also, since libbpf appends the only called subprogram last, this
> > subprogram's gotox ends up as the final instruction of the whole loaded
> > program. Would adding a further subprogram after it give coverage of the
> > fall-through-into-the-next-subprog case that the relaxed check in
> > check_subprogs() guards?
>
> If you add a macro as robot suggested, then the
> jump_table_terminal_gotox_subprog() below can call two subprogs
> (same, with different names).
>
> Otherwise, looks good to me!
>

Yes, makesense. I will respin it!

<SNIP>

Re: [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1320 bytes --]

> bpf: allow terminal gotox instructions

This isn't a bug, but Anton Protopopov requested capitalizing "allow" in
the commit title when he provided his Reviewed-by tag. Should this be
"bpf: Allow terminal gotox instructions"?

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8f585ceb2cd51..483473df7746c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -3107,7 +3109,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
>  		if (i == subprog_end - 1) {
>  			/* to avoid fall-through from one subprog into another
>  			 * the last insn of the subprog should be either exit
>  			 * or unconditional jump back or bpf_throw call
>  			 */
>  			if (code != (BPF_JMP | BPF_EXIT) &&
>  			    code != (BPF_JMP32 | BPF_JA) &&
> -			    code != (BPF_JMP | BPF_JA)) {
> +			    code != (BPF_JMP | BPF_JA) &&
> +			    !insn_is_gotox(&insn[i])) {

This isn't a bug, but would it be worth extending the comment above this
condition to mention gotox, since the accepted-terminator list right
below it now has a fourth entry?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511

Re: [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions

[Anton Protopopov]

On 26/08/31 11:26PM, bot+bpf-ci@kernel.org wrote:
> > bpf: allow terminal gotox instructions
> 
> This isn't a bug, but Anton Protopopov requested capitalizing "allow" in
> the commit title when he provided his Reviewed-by tag. Should this be
> "bpf: Allow terminal gotox instructions"?

+1

> 
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 8f585ceb2cd51..483473df7746c 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> 
> [ ... ]
> 
> > @@ -3107,7 +3109,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
> >  		if (i == subprog_end - 1) {
> >  			/* to avoid fall-through from one subprog into another
> >  			 * the last insn of the subprog should be either exit
> >  			 * or unconditional jump back or bpf_throw call
> >  			 */
> >  			if (code != (BPF_JMP | BPF_EXIT) &&
> >  			    code != (BPF_JMP32 | BPF_JA) &&
> > -			    code != (BPF_JMP | BPF_JA)) {
> > +			    code != (BPF_JMP | BPF_JA) &&
> > +			    !insn_is_gotox(&insn[i])) {
> 
> This isn't a bug, but would it be worth extending the comment above this
> condition to mention gotox, since the accepted-terminator list right
> below it now has a fourth entry?

I would ignore this, indirect jumps are unconditional as well

> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511