From: sashiko-bot@kernel.org
To: "Daniel Borkmann" <daniel@iogearbox.net>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next 14/18] bpf, x86: Multiply by 3, 5 and 9 with lea
Date: Tue, 13 Oct 2026 17:58:01 +0000 [thread overview]
Message-ID: <sashiko-outbox-170282@kernel.org> (raw)
In-Reply-To: <20261013171230.523677-15-daniel@iogearbox.net>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] bpf, x86: R12 ignored as SIB index, bypassing arena base
--
commit 67afba40c1efdd0d3dc72afceed029446b9b3578
Author: Daniel Borkmann <daniel@iogearbox.net>
bpf, x86: Multiply by 3, 5 and 9 with lea
The commit converts BPF multiplication by 3, 5, and 9 into x86 lea
instructions. It adds a scale parameter to emit_insn_suffix_SIB to
support the scale factor in the SIB byte.
> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index 4e9c6bbe93d0c..d1c22ae90fcc6 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
> @@ -1163,17 +1163,22 @@ static void emit_insn_suffix(u8 **pprog, u32 ptr_reg, u32 val_reg, int off)
> *pprog = prog;
> }
>
> -static void emit_insn_suffix_SIB(u8 **pprog, u32 ptr_reg, u32 val_reg, u32 index_reg, int off)
> +/*
> + * Emit the suffix for addressing *(ptr_reg + (index_reg << scale) + off)
> + * and val_reg, with a SIB byte
> + */
> +static void emit_insn_suffix_SIB(u8 **pprog, u32 ptr_reg, u32 val_reg, u32 index_reg, int off,
> + u8 scale)
> {
> + u8 sib = (scale << 6) | add_2reg(0, ptr_reg, index_reg);
^^^^
[Severity: Critical]
Does this code silently drop the arena base pointer if index_reg is
X86_REG_R12?
When index_reg is X86_REG_R12 (which has a value of 4), the SIB index field
becomes 100b. On x86-64, an index of 100b is interpreted as 'no index
register', so the CPU completely ignores the R12 base.
For BPF programs utilizing arena memory (e.g., via BPF_PROBE_MEM32),
functions like emit_ldx_r12(), emit_stx_r12(), and emit_st_r12() explicitly
pass X86_REG_R12 as the index register to emit_insn_suffix_SIB().
Because the R12 index is ignored, the kernel will incorrectly dereference
the user-provided 32-bit offset directly instead of adding it to the arena
base. This could allow a BPF program to read and write arbitrary user-space
memory, bypassing arena bounds.
> u8 *prog = *pprog;
>
> if (!off && !base_needs_disp(ptr_reg)) {
> - EMIT2(add_2reg(0x04, BPF_REG_0, val_reg),
> - add_2reg(0, ptr_reg, index_reg) /* SIB */);
> + EMIT2(add_2reg(0x04, BPF_REG_0, val_reg), sib);
> } else if (is_imm8(off)) {
> - EMIT3(add_2reg(0x44, BPF_REG_0, val_reg), add_2reg(0, ptr_reg, index_reg) /* SIB */, off);
> + EMIT3(add_2reg(0x44, BPF_REG_0, val_reg), sib, off);
> } else {
> - EMIT2_off32(add_2reg(0x84, BPF_REG_0, val_reg), add_2reg(0, ptr_reg, index_reg) /* SIB */, off);
> + EMIT2_off32(add_2reg(0x84, BPF_REG_0, val_reg), sib, off);
> }
> *pprog = prog;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261013171230.523677-1-daniel@iogearbox.net?part=14
next prev parent reply other threads:[~2026-10-13 17:58 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-13 17:12 [PATCH bpf-next 00/18] bpf: Various x86-64 BPF JIT improvements Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 01/18] bpf, x86: Drop redundant REX prefixes from zero and sign extensions Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 02/18] bpf, x86: Omit the displacement byte for zero offsets Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 03/18] bpf, x86: Shorten the stack adjusts and the tail call counter loads Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 04/18] bpf, x86: Use shorter test and cmp encodings for immediates Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 05/18] bpf, x86: Compare against 0, 127 and -128 with the adjusted condition Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 06/18] bpf, x86: Use movzx for byte and word masks and a not for xor with -1 Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 07/18] bpf, x86: Consolidate the ALU, shift and neg encodings into helpers Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 08/18] bpf, x86: Use shorter and faster forms for some ALU immediates Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 09/18] bpf, x86: Swap 16-bit values with bswap and shr, not ror and movzx Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 10/18] bpf, x86: Use BMI2 shifts also when the count is in rcx Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 11/18] bpf, x86: Fold the PROBE_MEM address computation into a lea Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 12/18] bpf, x86: Compare the PROBE_MEM address range with a shift Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 13/18] bpf, x86: Divide by constants via multiplication with a magic number Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 14/18] bpf, x86: Multiply by 3, 5 and 9 with lea Daniel Borkmann
2026-10-13 17:58 ` sashiko-bot [this message]
2026-10-13 19:15 ` Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 15/18] bpf, x86: Use emit_sub_rsp() for the trampoline stack Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 16/18] bpf, x86: Shorten the cast to a user address Daniel Borkmann
2026-10-13 17:12 ` [PATCH bpf-next 17/18] selftests/bpf: Add JIT instruction tests Daniel Borkmann
2026-10-13 18:46 ` bot+bpf-ci
2026-10-13 17:12 ` [PATCH bpf-next 18/18] selftests/bpf: Remove the old test_bpf module Daniel Borkmann
2026-10-13 18:22 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-170282@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox