diff options
| author | Siddharth Chintamaneni <sidchintamaneni@gmail.com> | 2026-09-02 17:14:13 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-09-12 10:26:05 -0700 |
| commit | 0d7823cd4cda35f2060a685fa276ff7709915abc (patch) | |
| tree | 029e1226d57c32239502a6c41f83bff28450b3a1 /kernel | |
| parent | 15071f2a1263e82150c77eeb1e94dbfc31950a8e (diff) | |
| download | linux-next-0d7823cd4cda35f2060a685fa276ff7709915abc.tar.gz linux-next-0d7823cd4cda35f2060a685fa276ff7709915abc.zip | |
bpf: Allow terminal gotox instructions
check_subprogs() treats gotox as a direct jump and validates its reserved
zero offset. When gotox is the final instruction, this produces a
synthetic successor one instruction past the end of the subprogram and
rejects an otherwise valid program.
Skip direct-offset validation for gotox and accept it as a
non-fallthrough terminal instruction. Its actual targets remain validated
from the instruction-array jump table during CFG construction.
Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com>
Link: https://lore.kernel.org/r/20260902171414.96165-1-sidchintamaneni@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1b0b1fb62878..ddba53eaa333 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3042,6 +3042,8 @@ static int check_subprogs(struct bpf_verifier_env *env) subprog[cur_subprog].exit_idx = i; goto next; } + if (insn_is_gotox(&insn[i])) + goto next; off = i + bpf_jmp_offset(&insn[i]) + 1; if (off < subprog_start || off >= subprog_end) { verbose(env, "jump out of range from insn %d to %d\n", i, off); @@ -3061,7 +3063,8 @@ next: */ if (code != (BPF_JMP | BPF_EXIT) && code != (BPF_JMP32 | BPF_JA) && - code != (BPF_JMP | BPF_JA)) { + code != (BPF_JMP | BPF_JA) && + !insn_is_gotox(&insn[i])) { verbose(env, "last insn is not an exit or jmp\n"); bpf_diag_program_structure( env, i, "subprogram can fall through", |