From: sashiko-bot@kernel.org
To: "Qiliang Yuan" <odys.yuan@gmail.com>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v2 22/22] selftests/bpf: Cover a backward may_goto pushed out of range by patches
Date: Fri, 30 Oct 2026 12:13:54 +0000 [thread overview]
Message-ID: <sashiko-outbox-191003@kernel.org> (raw)
In-Reply-To: <20261030-bpf-verifier-patch-batch-v2-22-55cd43439f7c@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] selftests/bpf: unguarded may_goto mnemonic in patch_list_may_goto_gotol()
--
commit eca3890b39b8864add1de9d7c74a0378b21864ca
Author: Qiliang Yuan <odys.yuan@gmail.com>
selftests/bpf: Cover a backward may_goto pushed out of range by patches
This commit adds a BPF verifier selftest checking that a backward may_goto
instruction pushed out of the 16-bit offset range by instruction patches is
expanded to gotol.
> diff --git a/tools/testing/selftests/bpf/progs/verifier_patch_list.c b/tools/testing/selftests/bpf/progs/verifier_patch_list.c
> index 1370cdd5e5836..302e739caf83c 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_patch_list.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_patch_list.c
> @@ -172,4 +172,39 @@ l0_%=: \
> }
> #endif
>
> +/*
> + * may_goto jumps back by 8195 insns, by 32768 once each of the 8191
> + * divisions is guarded by a patch of 4 insns. That still fits the 16 bits of
> + * may_goto, but not the jump it expands to, which has to become gotol. Once
> + * the budget runs out, may_goto jumps back with r6 set and the program exits.
> + */
> +SEC("raw_tp")
> +__description("patch list: backward may_goto expanded to gotol")
> +__arch_x86_64
> +__success
> +__xlated("...")
> +__xlated("{{[0-9]+}}: gotol pc-{{[0-9]+}}")
> +__naked void patch_list_may_goto_gotol(void)
> +{
> + asm volatile (" \
> + call %[bpf_get_prandom_u32]; \
> + r1 = r0; \
> + r6 = 0; \
> + goto 0f; \
> +1: r0 = 0; \
> + exit; \
> +0: if r6 != 0 goto 1b; \
> + .rept 8191; \
> + r0 /= r1; \
> + .endr; \
> + r2 = 0; \
> + r6 = 1; \
> + may_goto 0b; \
[Severity: Medium]
Will this break the selftest build on toolchains whose assembler does not
support the literal may_goto mnemonic (such as Clang prior to 19 or bpf-gcc
when building test_progs-bpf_gcc)?
Other tests that emit the literal may_goto mnemonic in inline assembly guard
it with #ifdef __BPF_FEATURE_MAY_GOTO, while the sibling test
patch_list_may_goto() in this same file encodes the instruction directly:
tools/testing/selftests/bpf/progs/verifier_patch_list.c:patch_list_may_goto() {
...
".8byte %[may_goto];"
"r0 /= r1;"
"exit;"
:
: __imm(bpf_get_prandom_u32),
__imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND, 0, 0, 1 /* offset */, 0))
...
}
Should patch_list_may_goto_gotol() either encode the instruction via
.8byte %[may_goto] with __imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND,
0, 0, -8195, 0)) or be guarded with #ifdef __BPF_FEATURE_MAY_GOTO?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261030-bpf-verifier-patch-batch-v2-0-55cd43439f7c@gmail.com?part=22
prev parent reply other threads:[~2026-10-30 12:13 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-30 11:51 [PATCH bpf-next v2 00/22] bpf: Replace bpf_patch_insn_data() with a list of deferred patches Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 01/22] bpf: Add a list of deferred instruction patches Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 02/22] bpf: Remap the verifier state through the patch list Qiliang Yuan
2026-10-30 12:44 ` bot+bpf-ci
2026-10-30 11:51 ` [PATCH bpf-next v2 03/22] bpf: Apply single-instruction patches of the verifier in place Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 04/22] bpf: Queue the rewrites of bpf_do_misc_fixups() Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 05/22] bpf: Expand a backward may_goto to gotol when patches push it out of range Qiliang Yuan
2026-10-30 12:59 ` bot+bpf-ci
2026-10-30 11:51 ` [PATCH bpf-next v2 06/22] bpf: Drop the constant delta from bpf_do_misc_fixups() Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 07/22] bpf: Let the patch list remove instructions Qiliang Yuan
2026-10-30 12:11 ` sashiko-bot
2026-10-30 11:51 ` [PATCH bpf-next v2 08/22] bpf: Remove dead code through the patch list Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 09/22] bpf: Strip nops " Qiliang Yuan
2026-10-30 12:45 ` bot+bpf-ci
2026-10-30 11:51 ` [PATCH bpf-next v2 10/22] bpf: Batch the patches of bpf_opt_subreg_zext_lo32_rnd_hi32() Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 11/22] bpf: Allow patching an instruction twice through the patch list Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 12/22] bpf: Teach the patch list to insert in front of an instruction Qiliang Yuan
2026-10-30 12:44 ` bot+bpf-ci
2026-10-30 11:51 ` [PATCH bpf-next v2 13/22] bpf: Allow inserting in front of a queued patch Qiliang Yuan
2026-10-30 11:51 ` [PATCH bpf-next v2 14/22] bpf: Move bpf_convert_ctx_accesses() to the patch list Qiliang Yuan
2026-10-30 12:24 ` sashiko-bot
2026-10-30 11:52 ` [PATCH bpf-next v2 15/22] bpf: Insert the may_goto counter setup through " Qiliang Yuan
2026-10-30 11:52 ` [PATCH bpf-next v2 16/22] bpf: Append the hidden subprog " Qiliang Yuan
2026-10-30 11:52 ` [PATCH bpf-next v2 17/22] bpf: Inline bpf_loop() calls " Qiliang Yuan
2026-10-30 11:52 ` [PATCH bpf-next v2 18/22] bpf: Apply the patch list without a verifier env Qiliang Yuan
2026-10-30 11:52 ` [PATCH bpf-next v2 19/22] bpf: Blind constants through the patch list Qiliang Yuan
2026-10-30 12:44 ` bot+bpf-ci
2026-10-30 11:52 ` [PATCH bpf-next v2 20/22] bpf: Remove the old instruction patching code Qiliang Yuan
2026-10-30 11:52 ` [PATCH bpf-next v2 21/22] selftests/bpf: Test jumps around patches of bpf_do_misc_fixups() Qiliang Yuan
2026-10-30 11:52 ` [PATCH bpf-next v2 22/22] selftests/bpf: Cover a backward may_goto pushed out of range by patches Qiliang Yuan
2026-10-30 12:13 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-191003@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=odys.yuan@gmail.com \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox