From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEB4B30FC39 for ; Mon, 22 Jun 2026 14:58:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782140289; cv=none; b=kSH5YnRkHoEWXB2XdwVh0VmNKR+s03NmNzmjoNIPWDNpyp737ZcNVUU28RNc0jYx402uCFBM7yYXRqJENrv32fkBtWhKnd8tBV7n/u6Prk66/ZVvV52cN7Xp+JxCXDAapU4hG9BiJp91LDPiY+F9mUZJCNoH9GmrcB60uoZnKVQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782140289; c=relaxed/simple; bh=k28+ZIV2l5YWcgHsEzl4opaw1tbnkXbA/EEb1aiO1qQ=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=iK9zXuAjNBHXojo4H52J0/Kr1h7QcdrWALP1AAc3ceP60gHo/QLy/YDCEuoiqI+5EzBp6GYx3zEvfokeNCt99liVjTy6JErrkEaeH9mXArvGM1qY/Y1twkxnc90qkQ0Oh1G8Z08nKuVK6dYC0NMSHi0KfxlDAlHdFDp+RIUliz8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ssml1LFe; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ssml1LFe" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4922244f7c7so39237845e9.0 for ; Mon, 22 Jun 2026 07:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782140286; x=1782745086; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=9fezmz/BGRlRBwNLlrK8/Pu93nh9Kq6eKRwwsJESYo0=; b=Ssml1LFeFKEqZ0sDnVVK2+DjoK+Wc5rOcLsSGE74gwnFinoQGlvQkDnfNg1OUBLSHi CYfaZPny3LDPqzgyfee248VGqhcCaR9fGQDqJOkCl62nga6Z0Q2sMVFsvr3P6mI3YRDh 9Zmc0Dd0xxs81HNCCbRin4wB77sCVEw5VndivQWwgjuLhzC6Bt02ualjT9+iWQD/vit/ ahPLqqRbCMdI1S1LDtjF5T+xD4umZPgv8lLm0/kXFYQCATnT7sORkpsCK5M8IjRd9nuV mg6mMnr8wizcT7pk36fG83buqBMX2XGP/vmFQKmUd1Jd4sn47CH/jfe76B6ZIwk1MhOo kyvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782140286; x=1782745086; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9fezmz/BGRlRBwNLlrK8/Pu93nh9Kq6eKRwwsJESYo0=; b=bG96Bj2ZOpBunaaUxRnzj9ue2X14gmzqLUcAM4dmNYyapZrnwQKGuTAAwTXyWtr9jl IK/9J6ObitlvvJte/QpYViKweogCvpzlOZzX+ojjOrmwHLsEb7v0/0+1tNlbtmItIM79 lDeJjIpq2tPu/dn953CmKMZVMnbbk8BGmsLe+46O6UNg4U4ir/GdNMJTfiK55fYWbW8D oppEH/PyTIWbEgPpiR8v8Zw3POMxHNryahWFEu2b2hheuvFO2zYlRuCiaBI3h6c+ywv+ WvMK6mjSfWwpctD4Utj5SDjjM8cxuTNVTjI85JIJPopEUEB75WixzRiDUkgdKU5QNH20 wnCQ== X-Forwarded-Encrypted: i=1; AFNElJ8Xgr3ZO+3Lr/HW0AdZkjBu6URU9PiRofA7xRfiqltrJzwhZBcnh3fESw/7F0SsmFTywqzkAoYjmBRFbBY=@vger.kernel.org X-Gm-Message-State: AOJu0YyqWl+hL9N3+AT/lAdtpDqPH67R6C+F4OR3yJ1oZX43nsmycAoU BAjvhh52MN1yQgnwSrQN2qLB2x4AUDt0qigqniJ3jBwPpugb7RbY3uSu X-Gm-Gg: AfdE7cnLqi6YDmRmjr2UcDzECmUsFO81UeBH1V6/gt05/cSmrtbgAK97r9BUnpzvd3k GuQ/9FSIdnNDz4fFD4B52cf/819rukovEyRNQr9Fs7b0pS9Rw1cuVoQJRC33Rd1ltPP5z64QMbB BTgjxHnBvIG4TWOA1l7yMqkl/R4ewLLPYZ30gBEUP2xJNW5zzCRqVJXT1qr1w1GGrV2sDSwVHjQ T2kJhc132eS9FXraLj9kJXnDH49aHpSzjl9YHP3g1Zi7xAaqEFDUKAuMovvo7eiVI+qLevie3df 2r5FnV5Jq3WnsD6SoAftDo184yiMbNHUqCPUNIGzRqLtrqIPNkDdxW2vaFDsn4HOaFXVPg1OKeV HZcPCKWceRDgmqIAFZveq9gC3ry1nW7yZgfVZDwrFHDQ3OjaSAxk+Oms/PlckI8IUWocr7+YSKr CIZ6Ys2P9oOX4V31s59s8ZxQ== X-Received: by 2002:a05:600c:5489:b0:492:4668:27b5 with SMTP id 5b1f17b1804b1-4924668299emr206920795e9.6.1782140286009; Mon, 22 Jun 2026 07:58:06 -0700 (PDT) Received: from mail.gmail.com ([2a04:ee41:4:b2de:1ac0:4dff:fe0f:3782]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-46667221da1sm26522740f8f.36.2026.06.22.07.58.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jun 2026 07:58:05 -0700 (PDT) Date: Mon, 22 Jun 2026 15:08:03 +0000 From: Anton Protopopov To: Nuoqi Gui Cc: bpf@vger.kernel.org, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Shuah Khan , linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH bpf-next v2 1/2] bpf: Enforce gotox targets against subprog bounds Message-ID: References: <20260613-f01-02-gotox-bpf-next-v2-send-v2-0-ff980bc5a329@mails.tsinghua.edu.cn> <20260613-f01-02-gotox-bpf-next-v2-send-v2-1-ff980bc5a329@mails.tsinghua.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260613-f01-02-gotox-bpf-next-v2-send-v2-1-ff980bc5a329@mails.tsinghua.edu.cn> On 26/06/13 05:33PM, Nuoqi Gui wrote: > CFG construction records the modeled gotox target set in > insn_aux_data->jt. It includes INSN_ARRAY maps based on whether the map > target is in the current subprog. check_indirect_jump() later validates and > follows the current PTR_TO_INSN register's actual INSN_ARRAY map. The > verifier does not check that targets copied from that map stay inside the > same subprog as the gotox instruction. > > This lets one gotox instruction observe two different INSN_ARRAY maps. CFG > can select a map whose target is in the current subprog. Another path to > the same gotox can carry a PTR_TO_INSN value from a map whose target points > at a different subprog. The verifier then accepts a cross-subprog edge that > CFG construction did not allow for this gotox instruction. Functionally, the patch is ok. But IMHO the commit message is too complex. Please consider making it shorter, if it will be respinned. > On x86, gotox becomes a raw indirect jump in the JIT image. Accepting a > target outside the gotox subprog can enter another subprog without a > matching BPF call frame and crash when executed. Validation observed a GPF > in bpf_test_run(). > > Fix this by requiring every target copied from the actual PTR_TO_INSN > map to stay within the subprog that contains the current gotox instruction. 'the subprog that contains the current gotox instruction' -> 'the calling subprog'? > Reject the program before pushing verifier states for any cross-subprog > target. Is this sentence needed at all? ^ > > Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") > Signed-off-by: Nuoqi Gui > --- > kernel/bpf/verifier.c | 21 +++++++++++++++++++++ > 1 file changed, 21 insertions(+) > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index eb46a81a8c51..98d3fa2f162a 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -17145,9 +17145,11 @@ static int indirect_jump_min_max_index(struct bpf_verifier_env *env, > static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *insn) > { > struct bpf_verifier_state *other_branch; > + struct bpf_subprog_info *subprog; > struct bpf_reg_state *dst_reg; > struct bpf_map *map; > u32 min_index, max_index; > + int subprog_start, subprog_end; > int err = 0; > int n; > int i; > @@ -17188,6 +17190,25 @@ static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *in > return -EINVAL; > } > > + subprog = bpf_find_containing_subprog(env, env->insn_idx); > + if (verifier_bug_if(!subprog, env, > + "gotox insn %d is outside subprog bounds\n", > + env->insn_idx)) > + return -EFAULT; > + subprog_start = subprog->start; > + subprog_end = (subprog + 1)->start; > + > + for (i = 0; i < n; i++) { > + u32 target = env->gotox_tmp_buf->items[i]; > + > + if (target < subprog_start || target >= subprog_end) { > + verbose(env, > + "gotox target %u from map id=%d is outside subprog [%d,%d)\n", > + target, map->id, subprog_start, subprog_end); > + return -EINVAL; > + } > + } > + This could have been a helper to share code with create_jt(), but looks small enough to keep it as is. Reviewed-by: Anton Protopopov > for (i = 0; i < n - 1; i++) { > mark_indirect_target(env, env->gotox_tmp_buf->items[i]); > other_branch = push_stack(env, env->gotox_tmp_buf->items[i], > > -- > 2.34.1 >