Re: [PATCH bpf-next 4/5] bpf, x86: Add BPF_JMP32 | BPF_JA support to the i386 JIT

[bot+bpf-ci]

> Select the displacement by instruction class and reuse the existing
> unconditional jump lowering, including its self-jump and no-op handling.
> The shared unconditional-jump path handles instruction zero separately:
> its start is the prologue boundary, which has no preceding entry in
> the instruction-end address map.

The new arm at arch/x86/net/bpf_jit_comp32.c line 2536:

    else if (i + ja_off == -1)
        jmp_offset = PROLOGUE_SIZE - addrs[i];

This isn't just new-opcode handling. Before this patch, BPF_JMP | BPF_JA
with i + insn->off == -1 would execute:

    jmp_offset = addrs[i + insn->off] - addrs[i];

which reads addrs[-1], one int before the kmalloc_array(*addrs, prog->len)
allocation at line 2627. This happens because the i386 JIT uses a 0-based
addrs[] array where addrs[i] is the end offset of instruction i (line 2603),
with no entry for the start of instruction 0. The x86-64 JIT avoids this by
using a 1-based array with addrs[0] = proglen after the prologue
(bpf_jit_comp.c:2088).

The out-of-bounds read is reachable when a privileged program has an
unconditional back-edge to instruction 0, for example:

    0: r0 = *(u32 *)(r1 + 0);
    1: if r0 == 0 goto +1;
    2: goto -3;
    3: exit

At instruction 2, i=2, off=-3, target is instruction 0, so i+off == -1.
push_insn() (kernel/bpf/cfg.c:113) only rejects targets outside
[0, prog->len-1], so -1 is exactly the boundary the old code got wrong.

Should the changelog say explicitly that the instruction-zero arm fixes
an existing out-of-bounds addrs[-1] read for BPF_JMP | BPF_JA? Would it
make sense to split this into a separate patch with a Fixes: tag so it can
be backported independently of the new gotol support?

Also, the identical boundary bug remains in the conditional-jump paths that
were left untouched. The pattern addrs[i + insn->off] appears at lines 2454,
2503, and 2516, so if rX == Y goto <insn 0> still reads addrs[-1]. Does it
make sense to fix all the jump paths together to keep the file consistent?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/34921540254