On 6/13/26 2:33 AM, Nuoqi Gui wrote:
CFG construction records the modeled gotox target set in
insn_aux_data->jt. It includes INSN_ARRAY maps based on whether the map
target is in the current subprog. check_indirect_jump() later validates and
follows the current PTR_TO_INSN register's actual INSN_ARRAY map. The
verifier does not check that targets copied from that map stay inside the
same subprog as the gotox instruction.
This lets one gotox instruction observe two different INSN_ARRAY maps. CFG
can select a map whose target is in the current subprog. Another path to
the same gotox can carry a PTR_TO_INSN value from a map whose target points
at a different subprog. The verifier then accepts a cross-subprog edge that
CFG construction did not allow for this gotox instruction.
On x86, gotox becomes a raw indirect jump in the JIT image. Accepting a
target outside the gotox subprog can enter another subprog without a
matching BPF call frame and crash when executed. Validation observed a GPF
in bpf_test_run().
Fix this by requiring every target copied from the actual PTR_TO_INSN
map to stay within the subprog that contains the current gotox instruction.
Reject the program before pushing verifier states for any cross-subprog
target.
Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")
Signed-off-by: Nuoqi Gui <[email protected]>
Acked-by: Yonghong Song <[email protected]>
