Re: [PATCH bpf-next v3 0/2] bpf: Enforce gotox targets against subprog bounds

[Anton Protopopov]

On 26/06/28 09:59PM, Nuoqi Gui wrote:
> For gotox, CFG construction models the indirect-jump target set in
> insn_aux_data->jt, while do_check() later follows targets from the runtime
> PTR_TO_INSN register's own INSN_ARRAY map. If the same gotox can be
> reached with PTR_TO_INSN values from different maps, do_check() can accept
> a target outside the calling subprog.

Can we use some human-readable description here? Please just explain that maps
considered during the config stage must be a super-set of maps checked runtime.

> The observed x86 JIT case can then enter another subprog without a matching
> BPF call frame and crash when the program is run.

Sorry, but why the x86 is still here?

> 
> Fix this by rejecting gotox map targets outside the current gotox subprog.
> Add a regression test covering the two-map cross-subprog case.
> 
> v1 -> v2:
>   - Validate gotox runtime targets against the current subprog bounds instead
>     of scanning the CFG jump table.
>   - Fix the selftest expected error from -EACCES to -EINVAL.
> 
> v2 -> v3:
>   - Drop the Validation section from the cover letter.
>   - Clarify that the crash was observed through the x86 JIT path while the
>     verifier invariant is generic.
>   - Simplify the cover letter and commit message.
>   - Remove the unused skel argument from the raw-insn selftest.
>   - Move the raw-insn selftest to the end of test_bpf_gotox().
> 
> v1:
>   https://lore.kernel.org/bpf/20260609-f01-03-gotox-bpf-next-v1-0-b441d63a1559@xxxxxxxxxxxxxxxxxxxxx/
> 
> v2:
>   https://lore.kernel.org/bpf/20260613-f01-03-gotox-bpf-next-v2-send-v2-0-7c883b43f3c3@xxxxxxxxxxxxxxxxxxxxx/
> 
> Signed-off-by: Nuoqi Gui <gnq25@xxxxxxxxxxxxxxxxxxxxx>
> ---
> Nuoqi Gui (2):
>       bpf: Enforce gotox targets against subprog bounds
>       selftests/bpf: Add cross-subprog gotox target coverage
> 
>  kernel/bpf/verifier.c                              | 19 ++++++
>  tools/testing/selftests/bpf/prog_tests/bpf_gotox.c | 73 ++++++++++++++++++++++
>  2 files changed, 92 insertions(+)
> ---
> base-commit: 7bfb93e3475be9de894f1cecd3a727d3e1649b03
> change-id: 20260628-f01-03-gotox-bpf-next-1a7af91d2c82
> 
> Best regards,
> --  
> Nuoqi Gui <gnq25@xxxxxxxxxxxxxxxxxxxxx>
>