On 8/7/26 10:57, David Windsor wrote:
> commit 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call") updated
> emit_cfi() to emit FineIBT preambles for JIT-compiled BPF programs, but
> did not update emit_bpf_dispatcher(). When prog->bpf_func is not in the
> dispatcher table (e.g. an XDP_REDIRECT target program in a CPUMAP or
> DEVMAP, or BPF_PROG_TEST_RUN of an unattached prog), the dispatcher
> still jumps directly to prog->bpf_func. Without a FineIBT caller
> sequence, under FineIBT this raises #CP:
>
> Missing ENDBR: __cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10
> ------------[ cut here ]------------
> kernel BUG at arch/x86/kernel/cet.c:133!
> Oops: invalid opcode: 0000 [#1] SMP NOPTI
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
> RIP: 0010:do_kernel_cp_fault+0x126/0x130
> Call Trace:
> <TASK>
> exc_control_protection+0x46/0x80
> asm_exc_control_protection+0x2b/0x30
> RIP: 0010:__cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10
> bpf_prog_test_run+0xda/0x1b0
> __sys_bpf+0x70b/0x990
> __x64_sys_bpf+0x2d/0x50
> x64_sys_call+0x1079/0x2d40
> do_syscall_64+0x12a/0x3c0
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> </TASK>
>
> To fix this, we precede the indirect jump in emit_bpf_dispatcher() with
> the FineIBT caller sequence: load cfi_bpf_hash into %eax and subtract
> cfi_get_offset() from the target so it enters the preamble's real ENDBR.
> Only needed for CFI_FINEIBT.
>
> Fixes: 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call")
> Cc: [email protected]
> Signed-off-by: David Windsor <[email protected]>
> ---
> arch/x86/net/bpf_jit_comp.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index de7515ea1bea..1c8249d8ca3b 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
> @@ -3740,6 +3740,15 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int
> b, s64 *progs, u8 *image,
> if (err)
> return err;
>
> + /* If running under FineIBT, enter the preamble so the following
> + * indirect jump lands on a real ENDBR instead of the poison.
> + */
Comment style: /* should stay at its own line.
> + if (cfi_mode == CFI_FINEIBT) {
> + EMIT1_off32(0xb8, cfi_bpf_hash); /* mov
> $cfi_bpf_hash, %eax */
> + EMIT1(add_1mod(0x48, BPF_REG_3)); /* sub rdx,
> cfi_get_offset() */
> + EMIT2_off32(0x81, add_1reg(0xE8, BPF_REG_3),
> cfi_get_offset());
> + }
Better to emit_cfi()?
Thanks,
Leon
> +
> emit_indirect_jump(&prog, BPF_REG_3 /* R3 -> rdx */, image +
> (prog - buf));
>
> *pprog = prog;
