Re: Re: [PATCH bpf-next v2 0/2] bpf: Enforce gotox targets against subprog bounds

[Nuoqi Gui]

> -----Original Messages-----
> From: "Anton Protopopov" <a.s.protopopov@xxxxxxxxx>
> Send time:Monday, 22/06/2026 23:17:34
> To: "Nuoqi Gui" <gnq25@xxxxxxxxxxxxxxxxxxxxx>
> Cc: bpf@xxxxxxxxxxxxxxx, "Alexei Starovoitov" <ast@xxxxxxxxxx>, "Daniel Borkmann" <daniel@xxxxxxxxxxxxx>, "Andrii Nakryiko" <andrii@xxxxxxxxxx>, "Eduard Zingerman" <eddyz87@xxxxxxxxx>, "Shuah Khan" <shuah@xxxxxxxxxx>, linux-kselftest@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx
> Subject: Re: [PATCH bpf-next v2 0/2] bpf: Enforce gotox targets against subprog bounds
> 
> On 26/06/13 05:33PM, Nuoqi Gui wrote:
> > For gotox, CFG construction models the indirect-jump target set in
> > insn_aux_data->jt, but do_check() later follows targets from the runtime
> > PTR_TO_INSN register's own INSN_ARRAY map. If the same gotox can be
> > reached with PTR_TO_INSN values from different maps, do_check() can accept
> > a target outside the subprog that CFG allowed for the gotox instruction.
> > 
> > On x86, that can transfer control into another subprog without a matching
> > BPF call frame and crash when the program is run.
> 
> Why only on x86?
> 
I will avoid making the x86 wording sound like the verifier issue is x86-specific. 
The issue was observed through the x86 JIT path, but the invariant being fixed is 
the generic gotox subprog-boundary check.

> > Fix this by rejecting gotox map targets outside the current gotox subprog.
> > Add a regression test covering the two-map cross-subprog case.
> > 
> > Validation:
> > 
> >   unpatched bpf-next 7bfb93e3475b with the new selftest:
> >     bpf_gotox/check-cross-subprog-gotox-target: FAIL
> >     cross_subprog_gotox_prog_load: actual 23 != expected -22
> >     __TEST_PROGS_RC__=1
> > 
> >   patched bpf-next 7bfb93e3475b + this series:
> >     bpf_gotox/check-cross-subprog-gotox-target: OK
> >     ./test_progs -t bpf_gotox/check-cross-subprog-gotox-target
> >     Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED
> >     __TEST_PROGS_RC__=0
> 
> Why the second part mentions the call to ./test_progs, and the first doesn't?
> Why the test result goes before the test run? Is this "Validation" section even required?
> 
Agreed, the Validation section is not needed in the cover letter. I will drop it 
in v3 instead of trying to keep the command/output formatting there.

> > v1 -> v2:
> >   - Validate gotox runtime targets against the current subprog bounds instead
> >     of scanning the CFG jump table.
> >   - Fix the selftest expected error from -EACCES to -EINVAL.
> > 
> > v1:
> >   https://lore.kernel.org/bpf/20260609-f01-02-gotox-bpf-next-v1-0-b441d63a1559@xxxxxxxxxxxxxxxxxxxxx/
> > 
> > Signed-off-by: Nuoqi Gui <gnq25@xxxxxxxxxxxxxxxxxxxxx>
> > ---
> > Nuoqi Gui (2):
> >       bpf: Enforce gotox targets against subprog bounds
> >       selftests/bpf: Add cross-subprog gotox target coverage
> > 
> >  kernel/bpf/verifier.c                              | 21 +++++++
> >  tools/testing/selftests/bpf/prog_tests/bpf_gotox.c | 73 ++++++++++++++++++++++
> >  2 files changed, 94 insertions(+)
> > ---
> > base-commit: 7bfb93e3475be9de894f1cecd3a727d3e1649b03
> > change-id: 20260613-f01-02-gotox-bpf-next-v2-send-8c48c9357dde
> > 
> > Best regards,
> > --  
> > Nuoqi Gui <gnq25@xxxxxxxxxxxxxxxxxxxxx>
> >