From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-173.mta0.migadu.com (out-173.mta0.migadu.com [91.218.175.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98CA41A9F82 for ; Wed, 8 Jul 2026 03:30:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783481426; cv=none; b=tZsiRtx8pQzve+vzCJ2pYu7k+39TaiA84nzmm1nc3V96ZFgyZoJX9647AwG8z4ep/vdrSeHTc1603sgv1vs/z3wx1HC23XRch/6et+lJEXP5HzgXpWdCGIbf8i+ZiDOQD/KCoHcjQEyCjKBsspaau85C40d3cLWiYrxlv+MFJKU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783481426; c=relaxed/simple; bh=4SeRtoGkiJ0YU+DChKH2d4yuDJUGWWHBlkzM6OpeQFU=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=CmN1QQvjNwzWs9fQNh6kCxqjbEImgGxQegzcScXhCpAU/kyMvMeEHMHg1oI3dpmtuDJRejkyEnYQS7ispM654wDkT1qZzFT3+avhUTcfKr/Jw0+iJYvVzVC4ouuvzjsaegEY9qxT/s+uFwH+Ewy9mb62hoLz/tIPzYEUs2yFy20= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=KeC+qsRv; arc=none smtp.client-ip=91.218.175.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="KeC+qsRv" Message-ID: <6702d2f1-dcd4-4b68-b1ac-daa8661235a0@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1783481422; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hAfIYp1qkUw5nv6HMpuzXiAFinGF8d61HsxbLIT9CoI=; b=KeC+qsRvkercaCeJMK0baG7g9L7IgTKrKgPQLRzPzmRJhODWz3t6hFjU3qk3vjnirrr/PY LEAGp/rwAN1aiEXn0JNmpcePjQBzkbz42gsEWfYnJ5dCk0RlqCHZAPCVHFv3oTVnUGadbf 4XsOUfePghJg0y58QGJAtrnwoi4vNvk= Date: Wed, 8 Jul 2026 11:30:06 +0800 Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH bpf 1/2] bpf, x86: Fix FineIBT #CP in BPF dispatcher's indirect-jump fallback Content-Language: en-US To: David Windsor , bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H . Peter Anvin" , "David S . Miller" , Jakub Kicinski , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Shuah Khan , Peter Zijlstra , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org References: X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Leon Hwang In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT On 8/7/26 10:57, David Windsor wrote: > commit 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call") updated > emit_cfi() to emit FineIBT preambles for JIT-compiled BPF programs, but > did not update emit_bpf_dispatcher(). When prog->bpf_func is not in the > dispatcher table (e.g. an XDP_REDIRECT target program in a CPUMAP or > DEVMAP, or BPF_PROG_TEST_RUN of an unattached prog), the dispatcher > still jumps directly to prog->bpf_func. Without a FineIBT caller > sequence, under FineIBT this raises #CP: > > Missing ENDBR: __cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10 > ------------[ cut here ]------------ > kernel BUG at arch/x86/kernel/cet.c:133! > Oops: invalid opcode: 0000 [#1] SMP NOPTI > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 > RIP: 0010:do_kernel_cp_fault+0x126/0x130 > Call Trace: > > exc_control_protection+0x46/0x80 > asm_exc_control_protection+0x2b/0x30 > RIP: 0010:__cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10 > bpf_prog_test_run+0xda/0x1b0 > __sys_bpf+0x70b/0x990 > __x64_sys_bpf+0x2d/0x50 > x64_sys_call+0x1079/0x2d40 > do_syscall_64+0x12a/0x3c0 > entry_SYSCALL_64_after_hwframe+0x76/0x7e > > > To fix this, we precede the indirect jump in emit_bpf_dispatcher() with > the FineIBT caller sequence: load cfi_bpf_hash into %eax and subtract > cfi_get_offset() from the target so it enters the preamble's real ENDBR. > Only needed for CFI_FINEIBT. > > Fixes: 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call") > Cc: stable@vger.kernel.org > Signed-off-by: David Windsor > --- > arch/x86/net/bpf_jit_comp.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c > index de7515ea1bea..1c8249d8ca3b 100644 > --- a/arch/x86/net/bpf_jit_comp.c > +++ b/arch/x86/net/bpf_jit_comp.c > @@ -3740,6 +3740,15 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs, u8 *image, > if (err) > return err; > > + /* If running under FineIBT, enter the preamble so the following > + * indirect jump lands on a real ENDBR instead of the poison. > + */ Comment style: /* should stay at its own line. > + if (cfi_mode == CFI_FINEIBT) { > + EMIT1_off32(0xb8, cfi_bpf_hash); /* mov $cfi_bpf_hash, %eax */ > + EMIT1(add_1mod(0x48, BPF_REG_3)); /* sub rdx, cfi_get_offset() */ > + EMIT2_off32(0x81, add_1reg(0xE8, BPF_REG_3), cfi_get_offset()); > + } Better to emit_cfi()? Thanks, Leon > + > emit_indirect_jump(&prog, BPF_REG_3 /* R3 -> rdx */, image + (prog - buf)); > > *pprog = prog;