For gotox, CFG construction models the indirect-jump target set in
insn_aux_data->jt, while do_check() later follows targets from the runtime
PTR_TO_INSN register's own INSN_ARRAY map. If the same gotox can be
reached with PTR_TO_INSN values from different maps, do_check() can accept
a target outside the calling subprog.
The observed x86 JIT case can then enter another subprog without a matching
BPF call frame and crash when the program is run.
Fix this by rejecting gotox map targets outside the current gotox subprog.
Add a regression test covering the two-map cross-subprog case.
v1 -> v2:
- Validate gotox runtime targets against the current subprog bounds instead
of scanning the CFG jump table.
- Fix the selftest expected error from -EACCES to -EINVAL.
v2 -> v3:
- Drop the Validation section from the cover letter.
- Clarify that the crash was observed through the x86 JIT path while the
verifier invariant is generic.
- Simplify the cover letter and commit message.
- Remove the unused skel argument from the raw-insn selftest.
- Move the raw-insn selftest to the end of test_bpf_gotox().
v1:
https://lore.kernel.org/bpf/20260609-f01-03-gotox-bpf-next-v1-0-b441d63a1...@mails.tsinghua.edu.cn/
v2:
https://lore.kernel.org/bpf/20260613-f01-03-gotox-bpf-next-v2-send-v2-0-7c883b43f...@mails.tsinghua.edu.cn/
Signed-off-by: Nuoqi Gui <[email protected]>
---
Nuoqi Gui (2):
bpf: Enforce gotox targets against subprog bounds
selftests/bpf: Add cross-subprog gotox target coverage
kernel/bpf/verifier.c | 19 ++++++
tools/testing/selftests/bpf/prog_tests/bpf_gotox.c | 73 ++++++++++++++++++++++
2 files changed, 92 insertions(+)
---
base-commit: 7bfb93e3475be9de894f1cecd3a727d3e1649b03
change-id: 20260628-f01-03-gotox-bpf-next-1a7af91d2c82
Best regards,
--
Nuoqi Gui <[email protected]>
