[PATCH stable 6.18 6.12 1/1] bpf, arm64: Reject out-of-range B.cond targets

[PATCH stable 6.18 6.12 1/1] bpf, arm64: Reject out-of-range B.cond targets

[Shung-Hsi Yu]

From: Daniel Borkmann <daniel@iogearbox.net>

commit 48d83d94930eb4db4c93d2de44838b9455cff626 upstream.

aarch64_insn_gen_cond_branch_imm() calls label_imm_common() to
compute a 19-bit signed byte offset for a conditional branch,
but unlike its siblings aarch64_insn_gen_branch_imm() and
aarch64_insn_gen_comp_branch_imm(), it does not check whether
label_imm_common() returned its out-of-range sentinel (range)
before feeding the value to aarch64_insn_encode_immediate().

aarch64_insn_encode_immediate() unconditionally masks the value
with the 19-bit field mask, so an offset that was rejected by
label_imm_common() gets silently truncated. With the sentinel
value SZ_1M, the resulting field ends up with bit 18 (the sign
bit of the 19-bit signed displacement) set, and the CPU decodes
it as a ~1 MiB *backward* branch, producing an incorrectly
targeted B.cond instruction. For code-gen locations like the
emit_bpf_tail_call() this function is the only barrier between
an overflowing displacement and a silently miscompiled branch.

Fix it by returning AARCH64_BREAK_FAULT when the offset is out
of range, so callers see a loud failure instead of a silently
misencoded branch. validate_code() scans the generated image
for any AARCH64_BREAK_FAULT and then lets the JIT fail.

Fixes: 345e0d35ecdd ("arm64: introduce aarch64_insn_gen_cond_branch_imm()")
Fixes: c94ae4f7c5ec ("arm64: insn: remove BUG_ON from codegen")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://lore.kernel.org/r/20260415121403.639619-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
---
Confirmed that after this patch is applied, BPF selftests on aarch64
still passes on 6.18[1] and 6.12[2].

1: https://github.com/kernel-patches/linux-stable/actions/runs/28509125434/job/84504843132
2: https://github.com/kernel-patches/linux-stable/actions/runs/28572297925/job/84712643104
---
 arch/arm64/lib/insn.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/lib/insn.c b/arch/arm64/lib/insn.c
index 4e298baddc2e..e9e9a70ac155 100644
--- a/arch/arm64/lib/insn.c
+++ b/arch/arm64/lib/insn.c
@@ -338,6 +338,8 @@ u32 aarch64_insn_gen_cond_branch_imm(unsigned long pc, unsigned long addr,
 	long offset;
 
 	offset = label_imm_common(pc, addr, SZ_1M);
+	if (offset >= SZ_1M)
+		return AARCH64_BREAK_FAULT;
 
 	insn = aarch64_insn_get_bcond_value();
 
-- 
2.54.0

Re: [PATCH stable 6.18 6.12 1/1] bpf, arm64: Reject out-of-range B.cond targets

[Sasha Levin]

On Thu, Jul 02, 2026 at 04:07:56PM +0800, Shung-Hsi Yu wrote:
> From: Daniel Borkmann <daniel@iogearbox.net>
>
> commit 48d83d94930eb4db4c93d2de44838b9455cff626 upstream.
>
> aarch64_insn_gen_cond_branch_imm() calls label_imm_common() to
> compute a 19-bit signed byte offset for a conditional branch,
> but unlike its siblings aarch64_insn_gen_branch_imm() and
> aarch64_insn_gen_comp_branch_imm(), it does not check whether
> label_imm_common() returned its out-of-range sentinel (range)
> before feeding the value to aarch64_insn_encode_immediate().

Queued up for 6.18.y and 6.12.y, thanks!

-- 
Thanks,
Sasha