Re: [PATCH bpf-next v3 24/24] selftests/bpf: Extend the JIT instruction tests for arm64 encodings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] selftests/bpf: misaligned XDP packet load in test_tail_call()
--

commit 3e5456182ae6e38cbc6f04091b8df4d4e305b794
Author: Daniel Borkmann <daniel@iogearbox.net>

selftests/bpf: Extend the JIT instruction tests for arm64 encodings

This commit extends the BPF JIT instruction selftests with additional test
cases covering compares, bit tests, constant arithmetic, immediates, sign
jumps, arena and PROBE_MEM accesses, and tail calls.

> diff --git a/tools/testing/selftests/bpf/prog_tests/jit_insns.c b/tools/testing/selftests/bpf/prog_tests/jit_insns.c
> index 5fd1c856ded72..0aaab23a2eef8 100644
> --- a/tools/testing/selftests/bpf/prog_tests/jit_insns.c
> +++ b/tools/testing/selftests/bpf/prog_tests/jit_insns.c

[ ... ]

> @@ -3093,6 +3598,94 @@ static void test_helper_calls(void)
>  	close(map_fd);
>  }
>  
> +/*
> + * A tail call with the index from the packet, which the JIT scales and takes
> + * the low 32 bits of: the entries return their index plus one, an empty one
> + * and an index from the array size on TAIL_FALL, the upper 32 bits ignored.
> + */
> +#define TAIL_ENTRIES	7
> +#define TAIL_FALL	0xfa11
> +
> +static void test_tail_call(void)
> +{

[ ... ]

> +	LIBBPF_OPTS(bpf_prog_load_opts, lopts,
> +		.log_buf = log,
> +		.log_size = sizeof(log),
> +	);

[ ... ]

> +	/* The index from the packet, a call which comes back returns TAIL_FALL */
> +	n = 0;
> +	insns[n++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
> +	insns[n++] = BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data));
> +	insns[n++] = BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data_end));
> +	insns[n++] = BPF_MOV64_REG(BPF_REG_4, BPF_REG_2);
> +	insns[n++] = BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8);
> +	insns[n++] = BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 5);
> +	insns[n++] = BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_2, 0);
> +	insns[n++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
> +	insns[n++] = BPF_RAW_INSN(BPF_LD | BPF_DW | BPF_IMM, BPF_REG_2, BPF_PSEUDO_MAP_FD, 0,
> +				  map_fd);
> +	insns[n++] = BPF_RAW_INSN(0, 0, 0, 0, 0);
> +	insns[n++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call);
> +	insns[n++] = BPF_MOV64_IMM(BPF_REG_0, TAIL_FALL);
> +	insns[n++] = BPF_EXIT_INSN();
> +	fd = bpf_prog_load(BPF_PROG_TYPE_XDP, NULL, "GPL", insns, n, &lopts);
> +	if (!ASSERT_GE(fd, 0, "tail call")) {

[Severity: Medium]
As reported by bot+bpf-ci@kernel.org on v2 [1], will the verifier reject
this BPF_DW load from the XDP packet pointer on architectures without
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS?

When strict alignment is enabled and lopts does not set
BPF_F_ANY_ALIGNMENT, check_pkt_ptr_alignment() adds NET_IP_ALIGN (2) to
the packet offset and rejects the 8-byte load at offset 0 with -EACCES,
causing the tail_call subtest to fail on strict-alignment targets.

[1] https://lore.kernel.org/r/eadd9b884e7ca42ebd241f55d6bfd3dd1c9628927b1425e46db2f7197efaeecc@mail.kernel.org

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794165614.git.daniel@iogearbox.net?part=24