Re: [PATCH bpf 1/2] bpf, x86: Fix FineIBT #CP in BPF dispatcher's indirect-jump fallback

[Leon Hwang <leon.hwang@linux.dev>]

On 8/7/26 10:57, David Windsor wrote:
> commit 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call") updated
> emit_cfi() to emit FineIBT preambles for JIT-compiled BPF programs, but
> did not update emit_bpf_dispatcher(). When prog->bpf_func is not in the
> dispatcher table (e.g. an XDP_REDIRECT target program in a CPUMAP or
> DEVMAP, or BPF_PROG_TEST_RUN of an unattached prog), the dispatcher
> still jumps directly to prog->bpf_func. Without a FineIBT caller
> sequence, under FineIBT this raises #CP:
> 
>   Missing ENDBR: __cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10
>   ------------[ cut here ]------------
>   kernel BUG at arch/x86/kernel/cet.c:133!
>   Oops: invalid opcode: 0000 [#1] SMP NOPTI
>   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
>   RIP: 0010:do_kernel_cp_fault+0x126/0x130
>   Call Trace:
>    <TASK>
>    exc_control_protection+0x46/0x80
>    asm_exc_control_protection+0x2b/0x30
>   RIP: 0010:__cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10
>    bpf_prog_test_run+0xda/0x1b0
>    __sys_bpf+0x70b/0x990
>    __x64_sys_bpf+0x2d/0x50
>    x64_sys_call+0x1079/0x2d40
>    do_syscall_64+0x12a/0x3c0
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>    </TASK>
> 
> To fix this, we precede the indirect jump in emit_bpf_dispatcher() with
> the FineIBT caller sequence: load cfi_bpf_hash into %eax and subtract
> cfi_get_offset() from the target so it enters the preamble's real ENDBR.
> Only needed for CFI_FINEIBT.
> 
> Fixes: 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Windsor <dwindsor@gmail.com>
> ---
>  arch/x86/net/bpf_jit_comp.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index de7515ea1bea..1c8249d8ca3b 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
> @@ -3740,6 +3740,15 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs, u8 *image,
>  		if (err)
>  			return err;
>  
> +		/* If running under FineIBT, enter the preamble so the following
> +		 * indirect jump lands on a real ENDBR instead of the poison.
> +		 */


Comment style: /* should stay at its own line.

> +		if (cfi_mode == CFI_FINEIBT) {
> +			EMIT1_off32(0xb8, cfi_bpf_hash);	/* mov $cfi_bpf_hash, %eax */
> +			EMIT1(add_1mod(0x48, BPF_REG_3));	/* sub rdx, cfi_get_offset() */
> +			EMIT2_off32(0x81, add_1reg(0xE8, BPF_REG_3), cfi_get_offset());
> +		}


Better to emit_cfi()?

Thanks,
Leon

> +
>  		emit_indirect_jump(&prog, BPF_REG_3 /* R3 -> rdx */, image + (prog - buf));
>  
>  		*pprog = prog;