diff options
| author | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2026-09-25 08:09:44 +0200 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-09-25 17:29:51 +0000 |
| commit | b9f30c763c7ecec41fd3f71b8a5a44971c3fddbf (patch) | |
| tree | 0979ce9d8d40da50dcbf2dc040e51955b862702c /kernel/bpf | |
| parent | 7af653d4ebf8e2e17e288715cd67ccf7845f4631 (diff) | |
| download | linux-b9f30c763c7ecec41fd3f71b8a5a44971c3fddbf.tar.gz linux-b9f30c763c7ecec41fd3f71b8a5a44971c3fddbf.zip | |
bpf: Check callx operand before requiring JIT support
check_func_callx() requires a JIT with callx support before it looks at
the register operand. On an architecture whose JIT doesn't support callx,
or when the JIT is disabled, every callx is thus rejected with "JIT
doesn't support callx" or "JIT is required to use callx", including one
whose operand is invalid. The "invalid call insn1" test_verifier test
expects "R0 !read_ok" for callx of an uninitialized register and fails
on s390x:
#79/u invalid call insn1 FAIL
Unexpected error message!
EXP: R0 !read_ok
RES: JIT doesn't support callx
Validate the operand first and require the JIT only for a callx that is
otherwise valid. An invalid callx is then rejected with the same message
on every architecture. This fixes various errors when running selftests
on JITs where callx is unsupported for now.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260925060945.1993547-1-memxor@gmail.com
Diffstat (limited to 'kernel/bpf')
| -rw-r--r-- | kernel/bpf/verifier.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 5c8626215ee6..cf9ff37cfdf2 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11216,10 +11216,6 @@ static int check_func_callx(struct bpf_verifier_env *env, struct bpf_insn *insn, const char *reason; int err, subprog; - err = require_callx_jit(env); - if (err) - return err; - err = check_reg_arg(env, insn->dst_reg, SRC_OP); if (err) return err; @@ -11245,6 +11241,11 @@ static int check_func_callx(struct bpf_verifier_env *env, struct bpf_insn *insn, if (err) return err; + /* the callx is valid, but only a JIT can execute it */ + err = require_callx_jit(env); + if (err) + return err; + /* PTR_TO_FUNC is a pointer to a static subprog */ subprog = reg->subprogno; err = btf_check_subprog_call(env, subprog, caller->regs); |