On Fri Jun 26, 2026 at 8:43 AM PDT, Leon Hwang wrote:
> Sashiko reported two potential issues about interpreter fallback [1]
> [2].
>
> After verifying them by patch #7, I think they are real issues. With
> LLM assistance, the interpreter does not support the internal
> BPF_PROBE_ATOMIC insn and the gotox insn (used for indirect jumps),
> either.
>
> 1) the user BPF_ADDR_SPACE_CAST insn
> the interpreter just ignores it.
>
> 2) the arena ST/STX/LDX insn
> the interpreter could hit the BUG_ON() in ___bpf_prog_run().
>
> 3) the BPF_MOV64_PERCPU_REG insn
> the interpreter could hit page fault, due to loading memory from
> invalid __percpu pointer.
>
> 4) the internal BPF_PROBE_ATOMIC insn
> the interpreter could hit the BUG_ON() in ___bpf_prog_run().
>
> 5) the gotox insn used for indirect jumps
> the interpreter could hit the BUG_ON() in ___bpf_prog_run(), too.
>
> Reject these insns on interpreter fallback path in
> __bpf_prog_select_runtime().
>
> This series is built on
> "bpf: Fix unaligned interpreter panic on JIT fallback path" [3]. The
> patch #7 is also able to verify the issue of un-JITed helper.
>
> However, The patch #7 aims to verify the issues. I think it is not
> proper to be applied to upstream, because it adds a stub
> 'bpf_jit_test_fail_task' to bpf_prog_jit_compile() for the tests.
>
> I'd like to drop the patch #7 in the next revision.
>
> Link:
> [1] https://lore.kernel.org/bpf/[email protected]/
> [2] https://lore.kernel.org/bpf/[email protected]/
> [3] https://lore.kernel.org/bpf/[email protected]/
I don't think we need such fallback in patch [3].
And approach taken by this set also doesn't scale, since it splits
the verifier/JIT logic into core.c which will be hard to keep consistent.
I think we need another bit like jit_requested in prog like 'must_jit'
that the verifier set for addr_space_cast, kfuncs and the rest.
Then the core.c change will be:
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 649cce41e13f..5126a43c1b81 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2620,7 +2620,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct
bpf_verifier_env *env, struct
goto finalize;
if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
- bpf_prog_has_kfunc_call(fp))
+ fp->must_jit)
jit_needed = true;
