Changes in bpf_insn_array.c

8457669db968c98edb781892d73fa559e1efcbd4 - Merge tag 'asoc-fix-v7.0-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Thu, 05 Mar 2026 16:22:14 +0000

Merge tag 'asoc-fix-v7.0-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v7.0A moderately large pile of fixes, though none of them are super major,plus a few new quirks and device IDs. List of files: /linux/kernel/bpf/bpf_insn_array.c

eb71ab2bf72260054677e348498ba995a057c463 - Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Sun, 01 Mar 2026 03:54:28 +0000

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfPull bpf fixes from Alexei Starovoitov: - Fix alignment of arm64 JIT buffer to prevent atomic tearing (Fuad Tabba) - Fix invariant violation for single value tnums in the verifier (Harishankar Vishwanathan, Paul Chaignon) - Fix a bunch of issues found by ASAN in selftests/bpf (Ihor Solodrai) - Fix race in devmpa and cpumap on PREEMPT_RT (Jiayuan Chen) - Fix show_fdinfo of kprobe_multi when cookies are not present (Jiri Olsa) - Fix race in freeing special fields in BPF maps to prevent memory leaks (Kumar Kartikeya Dwivedi) - Fix OOB read in dmabuf_collector (T.J. Mercier)* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (36 commits) selftests/bpf: Avoid simplification of crafted bounds test selftests/bpf: Test refinement of single-value tnum bpf: Improve bounds when tnum has a single possible value bpf: Introduce tnum_step to step through tnum's members bpf: Fix race in devmap on PREEMPT_RT bpf: Fix race in cpumap on PREEMPT_RT selftests/bpf: Add tests for special fields races bpf: Retire rcu_trace_implies_rcu_gp() from local storage bpf: Delay freeing fields in local storage bpf: Lose const-ness of map in map_check_btf() bpf: Register dtor for freeing special fields selftests/bpf: Fix OOB read in dmabuf_collector selftests/bpf: Fix a memory leak in xdp_flowtable test bpf: Fix stack-out-of-bounds write in devmap bpf: Fix kprobe_multi cookies access in show_fdinfo callback bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing selftests/bpf: Don't override SIGSEGV handler with ASAN selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN selftests/bpf: Fix array bounds warning in jit_disasm_helpers ... List of files: /linux/kernel/bpf/bpf_insn_array.c

5263e30fffbcc7934671f0421eafb87b690a01d2 - Merge branch 'close-race-in-freeing-special-fields-and-map-value'

Fri, 27 Feb 2026 23:39:01 +0000

Merge branch 'close-race-in-freeing-special-fields-and-map-value'Kumar Kartikeya Dwivedi says:====================Close race in freeing special fields and map valueThere exists a race across various map types where the freeing ofspecial fields (tw, timer, wq, kptr, etc.) can be done eagerly when alogical delete operation is done on a map value, such that the programwhich continues to have access to such a map value can recreate thefields and cause them to leak.The set contains fixes for this case. It is a continuation of Mykyta'sprevious attempt in [0], but applies to all fields. A test is includedwhich reproduces the bug reliably in absence of the fixes.Local Storage Benchmarks------------------------Evaluation Setup: Benchmarked on a dual-socket Intel Xeon Gold 6348 (IceLake) @ 2.60GHz (56 cores / 112 threads), with the CPU governor set toperformance. Bench was pinned to a single NUMA node throughout the test.Benchmark comes from [1] using the following command:./bench -p 1 local-storage-create --storage-type --batch-size <16,32,64>Before the test, 10 runs of all cases ([socket|task] x 3 batch sizes x 7iterations per batch size) are done to warm up and prime the machine.Then, 3 runs of all cases are done (with and without the patch, acrossreboots).For each comparison, we have 21 samples, i.e. per batch size (e.g.socket 16) of a given local storage, we have 3 runs x 7 iterations.The statistics (mean, median, stddev) and t-test is done for eachscenario (local storage and batch size pair) individually (21 samplesfor either case). All values are for local storage creations in thousandcreations / sec (k/s). Baseline (without patch) With patch Delta Case Median Mean Std. Dev. Median Mean Std. Dev. Median %---------------------------------------------------------------------------------------------------socket 16 432.026 431.941 1.047 431.347 431.953 1.635 -0.679 -0.16%socket 32 432.641 432.818 1.535 432.488 432.302 1.508 -0.153 -0.04%socket 64 431.504 431.996 1.337 429.145 430.326 2.469 -2.359 -0.55% task 16 38.816 39.382 1.456 39.657 39.337 1.831 +0.841 +2.17% task 32 38.815 39.644 2.690 38.721 39.122 1.636 -0.094 -0.24% task 64 37.562 38.080 1.701 39.554 38.563 1.689 +1.992 +5.30%The cases for socket are within the range of noise, and improvements in tasklocal storage are due to high variance (CV ~4%-6% across batch sizes). The onlystatistically significant case worth mentioning is socket with batch size 64with p-value from t-test < 0.05, but the absolute difference is small (~2k/s).TL;DR there doesn't appear to be any significant regression or improvement. [0]: https://lore.kernel.org/bpf/20260216131341.1285427-1-mykyta.yatsenko5@gmail.com [1]: https://lore.kernel.org/bpf/20260205222916.1788211-1-ameryhung@gmail.comChangelog:----------v2 -> v3v2: https://lore.kernel.org/bpf/20260227052031.3988575-1-memxor@gmail.com * Add syzbot Tested-by. * Add Amery's Reviewed-by. * Fix missing rcu_dereference_check() in __bpf_selem_free_rcu. (BPF CI Bot) * Remove migrate_disable() in bpf_selem_free_rcu. (Alexei)v1 -> v2v1: https://lore.kernel.org/bpf/20260225185121.2057388-1-memxor@gmail.com * Add Paul's Reviewed-by. * Fix use-after-free in accessing bpf_mem_alloc embedded in map. (syzbot CI) * Add benchmark numbers for local storage. * Add extra test case for per-cpu hashmap coverage with up to 16 refcount leaks. * Target bpf tree.====================Link: https://patch.msgid.link/20260227224806.646888-1-memxor@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

ae51772b1e94ba1d76db19085957dbccac189c1c - bpf: Lose const-ness of map in map_check_btf()

Fri, 27 Feb 2026 22:48:02 +0000

bpf: Lose const-ness of map in map_check_btf()BPF hash map may now use the map_check_btf() callback to decide whetherto set a dtor on its bpf_mem_alloc or not. Unlike C++ where members canopt out of const-ness using mutable, we must lose the const qualifier onthe callback such that we can avoid the ugly cast. Make the change andadjust all existing users, and lose the comment in hashtab.c.Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260227224806.646888-3-memxor@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

c17ee635fd3a482b2ad2bf5e269755c2eae5f25e - Merge drm/drm-fixes into drm-misc-fixes

Mon, 23 Feb 2026 09:09:45 +0000

Merge drm/drm-fixes into drm-misc-fixes7.0-rc1 was just released, let's merge it to kick the new release cycle.Signed-off-by: Maxime Ripard List of files: /linux/kernel/bpf/bpf_insn_array.c

cc4adab164b772a34b3340d644b7c4728498581e - Merge tag 'v6.19-rc1' into msm-next

Tue, 20 Jan 2026 22:06:55 +0000

Merge tag 'v6.19-rc1' into msm-nextMerge Linux 6.19-rc1 in order to catch up with other changes (e.g. UBWCconfig database defining UBWC_6).Signed-off-by: Dmitry Baryshkov List of files: /linux/kernel/bpf/bpf_insn_array.c

5add3c3c280a35f7e258e9cef7607db5a2e56fdc - Merge drm/drm-next into drm-xe-next

Fri, 19 Dec 2025 10:51:22 +0000

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.19-rc1. An important upstream bugfix andto help unblock PTL CI.Signed-off-by: Thomas Hellström List of files: /linux/kernel/bpf/bpf_insn_array.c

b8304863a3990d0f18c38e5b94191830a63ee1af - Merge drm/drm-next into drm-intel-next

Mon, 15 Dec 2025 13:24:02 +0000

Merge drm/drm-next into drm-intel-nextSync-up some display code needed for Async flips refactor.Signed-off-by: Rodrigo Vivi List of files: /linux/kernel/bpf/bpf_insn_array.c

7f790dd21a931c61167f7bdc327aecf2cebad327 - Merge drm/drm-next into drm-misc-next

Mon, 15 Dec 2025 08:27:39 +0000

Merge drm/drm-next into drm-misc-nextLet's kickstart the v6.20 (7.0?) release cycle.Signed-off-by: Maxime Ripard List of files: /linux/kernel/bpf/bpf_insn_array.c

f17b474e36647c23801ef8fdaf2255ab66dd2973 - Merge tag 'bpf-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Tue, 10 Feb 2026 19:26:21 +0000

Merge tag 'bpf-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextPull bpf updates from Alexei Starovoitov: - Support associating BPF program with struct_ops (Amery Hung) - Switch BPF local storage to rqspinlock and remove recursion detection counters which were causing false positives (Amery Hung) - Fix live registers marking for indirect jumps (Anton Protopopov) - Introduce execution context detection BPF helpers (Changwoo Min) - Improve verifier precision for 32bit sign extension pattern (Cupertino Miranda) - Optimize BTF type lookup by sorting vmlinux BTF and doing binary search (Donglin Peng) - Allow states pruning for misc/invalid slots in iterator loops (Eduard Zingerman) - In preparation for ASAN support in BPF arenas teach libbpf to move global BPF variables to the end of the region and enable arena kfuncs while holding locks (Emil Tsalapatis) - Introduce support for implicit arguments in kfuncs and migrate a number of them to new API. This is a prerequisite for cgroup sub-schedulers in sched-ext (Ihor Solodrai) - Fix incorrect copied_seq calculation in sockmap (Jiayuan Chen) - Fix ORC stack unwind from kprobe_multi (Jiri Olsa) - Speed up fentry attach by using single ftrace direct ops in BPF trampolines (Jiri Olsa) - Require frozen map for calculating map hash (KP Singh) - Fix lock entry creation in TAS fallback in rqspinlock (Kumar Kartikeya Dwivedi) - Allow user space to select cpu in lookup/update operations on per-cpu array and hash maps (Leon Hwang) - Make kfuncs return trusted pointers by default (Matt Bobrowski) - Introduce "fsession" support where single BPF program is executed upon entry and exit from traced kernel function (Menglong Dong) - Allow bpf_timer and bpf_wq use in all programs types (Mykyta Yatsenko, Andrii Nakryiko, Kumar Kartikeya Dwivedi, Alexei Starovoitov) - Make KF_TRUSTED_ARGS the default for all kfuncs and clean up their definition across the tree (Puranjay Mohan) - Allow BPF arena calls from non-sleepable context (Puranjay Mohan) - Improve register id comparison logic in the verifier and extend linked registers with negative offsets (Puranjay Mohan) - In preparation for BPF-OOM introduce kfuncs to access memcg events (Roman Gushchin) - Use CFI compatible destructor kfunc type (Sami Tolvanen) - Add bitwise tracking for BPF_END in the verifier (Tianci Cao) - Add range tracking for BPF_DIV and BPF_MOD in the verifier (Yazhou Tang) - Make BPF selftests work with 64k page size (Yonghong Song)* tag 'bpf-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (268 commits) selftests/bpf: Fix outdated test on storage->smap selftests/bpf: Choose another percpu variable in bpf for btf_dump test selftests/bpf: Remove test_task_storage_map_stress_lookup selftests/bpf: Update task_local_storage/task_storage_nodeadlock test selftests/bpf: Update task_local_storage/recursion test selftests/bpf: Update sk_storage_omem_uncharge test bpf: Switch to bpf_selem_unlink_nofail in bpf_local_storage_{map_free, destroy} bpf: Support lockless unlink when freeing map or local storage bpf: Prepare for bpf_selem_unlink_nofail() bpf: Remove unused percpu counter from bpf_local_storage_map_free bpf: Remove cgroup local storage percpu counter bpf: Remove task local storage percpu counter bpf: Change local_storage->lock and b->lock to rqspinlock bpf: Convert bpf_selem_unlink to failable bpf: Convert bpf_selem_link_map to failable bpf: Convert bpf_selem_unlink_map to failable bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage selftests/xsk: fix number of Tx frags in invalid packet selftests/xsk: properly handle batch ending in the middle of a packet bpf: Prevent reentrance into call_rcu_tasks_trace() ... List of files: /linux/kernel/bpf/bpf_insn_array.c

46c76760febfb14618d88f6a01fca2d93d003082 - Merge branch 'properly-load-insn-array-values-with-offsets'

Wed, 14 Jan 2026 03:35:14 +0000

Merge branch 'properly-load-insn-array-values-with-offsets'Anton Protopopov says:====================properly load insn array values with offsetsAs was reported by the BPF CI bot in [1] the direct addressof an instruction array returned by map_direct_value_addr()is incorrect if the offset is non-zero. Fix this bug andadd selftests.Also (commit 2), return EACCES instead of EINVAL when offsetsaren't correct. [1] https://lore.kernel.org/bpf/0447c47ac58306546a5dbdbad2601f3e77fa8eb24f3a4254dda3a39f6133e68f@mail.kernel.org/====================Link: https://patch.msgid.link/20260111153047.8388-1-a.s.protopopov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

7e525860e7250355bcb01ae9779154512b5e5e88 - bpf: Return EACCES for incorrect access to insn array

Sun, 11 Jan 2026 15:30:46 +0000

bpf: Return EACCES for incorrect access to insn arrayThe insn_array_map_direct_value_addr() function currently returns-EINVAL when the offset within the map is invalid. Change this toreturn -EACCES, so that it is consistent with similar boundary accesschecks in the verifier.Signed-off-by: Anton Protopopov Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260111153047.8388-3-a.s.protopopov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

e3bd7bdf5ffe49d8381e42843f6e98cd0c78a1e8 - bpf: Return proper address for non-zero offsets in insn array

Sun, 11 Jan 2026 15:30:45 +0000

bpf: Return proper address for non-zero offsets in insn arrayThe map_direct_value_addr() function of the instructionarray map incorrectly adds offset to the resulting address.This is a bug, because later the resolve_pseudo_ldimm64()function adds the offset. Fix it. Corresponding selftestsare added in a consequent commit.Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")Signed-off-by: Anton Protopopov Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260111153047.8388-2-a.s.protopopov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

24f171c7e145f43b9f187578e89b0982ce87e54c - Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Sun, 21 Dec 2025 10:11:11 +0000

Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.19We've been quite busy with fixes since the merge window, though not inany particularly exciting ways - the standout thing is the fix for _SXcontrols which were broken by a change to how we do clamping, otherwiseit's all fairly run of the mill fixes and quirks. List of files: /linux/kernel/bpf/bpf_insn_array.c

84318277d6334c6981ab326d4acc87c6a6ddc9b8 - Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes

Mon, 15 Dec 2025 11:53:27 +0000

Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixesPull in rc1 to include all changes since the merge window closed,and grab all fixes and changes from drm/drm-next.Signed-off-by: Maarten Lankhorst List of files: /linux/kernel/bpf/bpf_insn_array.c

015e7b0b0e8e51f7321ec2aafc1d7fc0a8a5536f - Merge tag 'bpf-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Thu, 04 Dec 2025 00:54:54 +0000

Merge tag 'bpf-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextPull bpf updates from Alexei Starovoitov: - Convert selftests/bpf/test_tc_edt and test_tc_tunnel from .sh to test_progs runner (Alexis Lothoré) - Convert selftests/bpf/test_xsk to test_progs runner (Bastien Curutchet) - Replace bpf memory allocator with kmalloc_nolock() in bpf_local_storage (Amery Hung), and in bpf streams and range tree (Puranjay Mohan) - Introduce support for indirect jumps in BPF verifier and x86 JIT (Anton Protopopov) and arm64 JIT (Puranjay Mohan) - Remove runqslower bpf tool (Hoyeon Lee) - Fix corner cases in the verifier to close several syzbot reports (Eduard Zingerman, KaFai Wan) - Several improvements in deadlock detection in rqspinlock (Kumar Kartikeya Dwivedi) - Implement "jmp" mode for BPF trampoline and corresponding DYNAMIC_FTRACE_WITH_JMP. It improves "fexit" program type performance from 80 M/s to 136 M/s. With Steven's Ack. (Menglong Dong) - Add ability to test non-linear skbs in BPF_PROG_TEST_RUN (Paul Chaignon) - Do not let BPF_PROG_TEST_RUN emit invalid GSO types to stack (Daniel Borkmann) - Generalize buildid reader into bpf_dynptr (Mykyta Yatsenko) - Optimize bpf_map_update_elem() for map-in-map types (Ritesh Oedayrajsingh Varma) - Introduce overwrite mode for BPF ring buffer (Xu Kuohai)* tag 'bpf-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (169 commits) bpf: optimize bpf_map_update_elem() for map-in-map types bpf: make kprobe_multi_link_prog_run always_inline selftests/bpf: do not hardcode target rate in test_tc_edt BPF program selftests/bpf: remove test_tc_edt.sh selftests/bpf: integrate test_tc_edt into test_progs selftests/bpf: rename test_tc_edt.bpf.c section to expose program type selftests/bpf: Add success stats to rqspinlock stress test rqspinlock: Precede non-head waiter queueing with AA check rqspinlock: Disable spinning for trylock fallback rqspinlock: Use trylock fallback when per-CPU rqnode is busy rqspinlock: Perform AA checks immediately rqspinlock: Enclose lock/unlock within lock entry acquisitions bpf: Remove runqslower tool selftests/bpf: Remove usage of lsm/file_alloc_security in selftest bpf: Disable file_alloc_security hook bpf: check for insn arrays in check_ptr_alignment bpf: force BPF_F_RDONLY_PROG on insn array creation bpf: Fix exclusive map memory leak selftests/bpf: Make CS length configurable for rqspinlock stress test selftests/bpf: Add lock wait time stats to rqspinlock stress test ... List of files: /linux/kernel/bpf/bpf_insn_array.c

19f4091bf2679759da877eb23a37863dc4368441 - Merge branch 'a-pair-of-follow-ups-for-indirect-jumps'

Fri, 28 Nov 2025 23:15:43 +0000

Merge branch 'a-pair-of-follow-ups-for-indirect-jumps'Anton Protopopov says:====================A pair of follow ups for indirect jumpsTwo fixes suggested by Alexei in [1]. Resending as a series,as the second patch depends on the first. [1] https://lore.kernel.org/bpf/CAADnVQK3piReoo1ja=9hgz7aJ60Y_Jjur_JMOaYV8-Mn_VyE4A@mail.gmail.com/#R====================Link: https://patch.msgid.link/20251128063224.1305482-1-a.s.protopopov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

7feff23cdf2ecd30909872f3be1da820df839ab0 - bpf: force BPF_F_RDONLY_PROG on insn array creation

Fri, 28 Nov 2025 06:32:23 +0000

bpf: force BPF_F_RDONLY_PROG on insn array creationThe original implementation added a hack to check_mem_access()to prevent programs from writing into insn arrays. To get ridof this hack, enforce BPF_F_RDONLY_PROG on map creation.Also fix the corresponding selftest, as the error message changeswith this patch.Suggested-by: Alexei Starovoitov Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251128063224.1305482-2-a.s.protopopov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

b54a8e130c0204330de0787d81b28d2a0c9dc871 - Merge branch 'bpf-indirect-jumps'

Thu, 06 Nov 2025 01:31:26 +0000

Merge branch 'bpf-indirect-jumps'Anton Protopopov says:====================BPF indirect jumpsThis patchset implements a new type of map, instruction set, and usesit to build support for indirect branches in BPF (on x86). (The samemap will be later used to provide support for indirect calls and statickeys.) See [1], [2] for more context.Short table of contents: * Patches 1-6 implement the new map of type BPF_MAP_TYPE_INSN_SET and corresponding selftests. This map can be used to track the "original -> xlated -> jitted mapping" for a given program. * Patches 7-12 implement the support for indirect jumps on x86 and add libbpf support for LLVM-compiled programs containing indirect jumps, and selftests.The jump table support was merged to LLVM and now can beenabled with -mcpu=v4, see [3]. The __BPF_FEATURE_GOTOXmacros can be used to check if the compiler supports thefeature or not.See individual patches for more details on the implementation details.v10 -> v11 (this series): * rearranged patches and split libbpf patch such that first 6 patches implementing instruction arrays can be applied independently * instruction arrays: * move [fake] aux->used_maps assignment in this patch * indirect jumps: * call clear_insn_aux_data before bpf_remove_insns (AI) * libbpf: * remove the relocations check after the new LLVM is released (Eduard, Yonghong) * libbpf: fix an index printed in pr_warn (AI) * selftests: * protect programs triggered by nanosleep from fake runs (Eduard) * patch verifier_gotox to not emit .rel.jumptablesv9 -> v10 (https://lore.kernel.org/bpf/20251102205722.3266908-1-a.s.protopopov@gmail.com/T/#t): * Three bugs were noticed by AI in v9 (two old, one introduced by v9): * [new] insn_array_alloc_size could overflow u32, switched to u64 (AI) * map_ptr should be compared in regsafe for PTR_TO_INSN (AI) * duplicate elements were copied in jt_from_map (AI) * added a selftest in verifier_gotox with a jump table containing non-unique entriesv8 -> v9 (https://lore.kernel.org/bpf/20251101110717.2860949-1-a.s.protopopov@gmail.com/T/#t): * instruction arrays: * remove the size restriction of 256 elements * add a comments about addrs usage, old and new (Alexei) * libbpf: * properly prefix warnings (Andrii) * cast j[t] to long long for printf and some other minor cleanups (Andrii) * selftests: * use __BPF_FEATURE_GOTOX in selftests and skip tests if it's not set (Eduard) * fix a typo in a selftest assembly (AI)v7 -> v8 (https://lore.kernel.org/bpf/20251028142049.1324520-1-a.s.protopopov@gmail.com/T/#u): * instruction arrays: * simplify the bpf_prog_update_insn_ptrs function (Eduard) * remove a semicolon after a function definition (AI) * libbpf: * add a proper error path in libbpf patch (AI) * re-re-factor the create_jt_map & find_subprog_idx (Eduard) * selftests: * verifier_gotox: add a test for a jump table pointing to outside of a subprog (Eduard) * used test__skip instead of just running an empty test * split tests in bpf_gotox into subtests for convenience * random: * drop the docs commit for nowv6 -> v7 (https://lore.kernel.org/bpf/20251026192709.1964787-1-a.s.protopopov@gmail.com/T/#t): * rebased and dropped already merged commits * instruction arrays * use jit_data to find mappings from insn to jit (Alexei) * alloc `ips` as part of the main allocation (Eduard) * the `jitted_ip` member wasn't actually used (Eduard) * remove the bpf_insn_ptr structure, which is not needed for this patch * indirect jumps, kernel: * fix a memory leak in `create_jt` (AI) * use proper reg+8*ereg in `its_static_thunk` (AI) * some minor cleanups (Eduard) * indirect jumps, libbpf: * refactor the `jt_adjust_off()` piece (Edurad) * move "JUMPTABLES_SEC" into libbpf_internal.h (Eduard) * remove an unnecessary if (Eduard) * verifier_gotox: add tests to verify that `gotox rX` works with all registersv5 -> v6 (https://lore.kernel.org/bpf/20251019202145.3944697-1-a.s.protopopov@gmail.com/T/#u): * instruction arrays: * better document `struct bpf_insn_array_value` (Eduard) * remove a condition in `bpf_insn_array_adjust_after_remove` (Eduard) * make userspace see original, xlated, and jitted indexes (+original) (Eduard) * indirect jumps, kernel: * reject writes to the map * reject unaligned ops * add a check what `w` is not outside the program in check_config for `gotox` (Eduard) * do not introduce unneeded `bpf_find_containing_subprog_idx` * simplify error processing for `bpf_find_containing_subprog` (Eduard) * add `insn_state |= DISCOVERED` when it's discovered (Eduard) * support SUB operations on PTR_TO_INSN (Eduard) * make `gotox_tmp_buf` a bpf_iarray and use helper to relocate it (Eduard) * rename fields of `bpf_iarray` to more generic (Eduard) * re-implement `visit_gotox_insn` in a loop (Eduard) * some minor cleanups (Eduard) * libbpf: * `struct reloc_desc`: add a comment about `union` (Eduard) * rename parameters of (and one other place in code) `{create,add}_jt_map` to `sym_off` (Eduard) * `create_jt_map`: check that size/off are 8-byte aligned (Eduard) * Selftests: * instruction array selftests: * only run tests on x86_64 * write a more generic function to test things to reduce code (Eduard) * errno wasn't used in checks, so don't reset it (Eduard) * print `i`, `xlated_off` and `map_out[i]` here (Eduard) * added `verifier_gotox` selftests which do not depend on LLVM: * disabled `bpf_gotox` tests by default * other changes: * remove an extra function in bpf disasm (Eduard) * some minor cleanups in the insn_successors patch (Eduard) * update documentation in `Documentation/bpf/linux-notes.html` about jumps, now it is supported :)v3 -> v4 -> v5 (https://lore.kernel.org/bpf/20250930125111.1269861-1-a.s.protopopov@gmail.com/): * [v4 -> v5] rebased on top of the last bpf-next/master * instruction arrays: * add copyright (Alexei) * remove mutexes, add frozen back (Alexei) * setup 1:1 prog-map correspondence using atomic_xchg * do not copy/paste array_map_get_next_key, add a common helper (Alexei) * misc minor code cleanups (Alexei) * indirect jumps, kernel side: * remove jt_allocated, just check if insn is gotox (Eduard) * use copy_register_state instead of individual copies (Eduard) * in push_stack is_speculative should be inherited (Eduard) * a few cleanups for insn_successors, including omitting error path (Eduard) * check if reserved fields are used when considering `gotox` instruction (Eduard) * read size and alignment of read from insn_array should be 8 (Eduard) * put buffer for sorting in subfun info and realloc to grow as needed (Eduard) * properly do `jump_point` / `prune_point` from `push_gotox_edge` (Eduard) * use range_within to check states (Eduard) * some minor cleanups and fix commit message (Eduard) * indirect jumps, libbpf side: * close map_fd in some error paths in create_jt_map (Andrii) * maps for jump tables are actually not closed at all, fix this (Andrii) * rename map from `jt` to `.jumptables` (Andrii) * use `errstr` in an error message (Andrii) * rephrase error message to look more standard (Andrii) * misc other minor renames and cleanups (Andrii) * selftests: * add the frozen selftest back * add a selftest for two jumps loading same table * some other changes: * rebase and split insn_successor changes into separate patch * use PTR_ERR_OR_ZERO in the push stack patch (Eduard) * indirect jumps on x86: properly re-read *pprog (Eduard)v2 -> v3 (https://lore.kernel.org/bpf/20250918093850.455051-1-a.s.protopopov@gmail.com/): * fix build failure when CONFIG_BPF_SYSCALL is not set (kbuild-bot) * reformat bpftool help messages (Quentin)v1 -> v2 (https://lore.kernel.org/bpf/20250913193922.1910480-1-a.s.protopopov@gmail.com/): * push_stack changes: * sanitize_speculative_path should just return int (Eduard) * return code from sanitize_speculative_path, not EFAULT (Eduard) * when BPF_COMPLEXITY_LIMIT_JMP_SEQ is reached, return E2BIG (Eduard) * indirect jumps: * omit support for .imm=fd in gotox, as we're not using it for now (Eduard) * struct jt -> struct bpf_iarray (Eduard) * insn_successors: rewrite the interface to just return a pointer (Eduard) * remove min_index/max_index, use umin_value/umax_value instead (Alexei, Eduard) * move emit_indirect_jump args change to the previous patch (Eduard) * add a comment to map_mem_size() (Eduard) * use verifier_bug for some error cases in check_indirect_jump (Eduard) * clear_insn_aux_data: use start,len instead of start,end (Eduard) * make regs[insn->dst_reg].type = PTR_TO_INSN part of check_mem_access (Eduard) * constant blinding changes: * make subprog_start adjustment better readable (Eduard) * do not set subprog len, it is already set (Eduard) * libbpf: * remove check that relocations from .rodata are ok (Anton) * do not freeze the map, it is not necessary anymore (Anton) * rename the goto_x -> gotox everywhere (Anton) * use u64 when parsing LLVM jump tables (Eduard) * split patch in two due to spaces->tabs change (Eduard) * split bpftool changes to bpftool patch (Andrii) * make sym_size it a union with ext_idx (Andrii) * properly copy/free the jumptables_data section from elf (Andrii) * a few cosmetic changes around create_jt_map (Andrii) * fix some comments + rewrite patch description (Andrii) * inline bpf_prog__append_subprog_offsets (Andrii) * subprog_sec_offst -> subprog_sec_off (Andrii) * !strcmp -> strcmp() == 0 (Andrii) * make some function names more readable (Andrii) * allocate table of subfunc offsets via libbpf_reallocarray (Andrii) * selftests: * squash insn_array* tests together (Anton) * fixed build warnings (kernel test robot)RFC -> v1 (https://lore.kernel.org/bpf/20250816180631.952085-1-a.s.protopopov@gmail.com/): * I've tried to address all the comments provided by Alexei and Eduard in RFC. Will try to list the most important of them below. * One big change: move from older LLVM version [5] to newer [4]. Now LLVM generates jump tables as symbols in the new special section ".jumptables". Another part of this change is that libbpf now doesn't try to link map load and goto *rX, as 1) this is absolutely not reliable 2) for some use cases this is impossible (namely, when more than one jump table can be used in the same gotox instruction). * Added insn_successors() support (Alexei, Eduard). This includes getting rid of the ugly bpf_insn_set_iter_xlated_offset() interface (Eduard). * Removed hack for the unreachable instruction, as new LLVM thank to Eduard doesn't generate it. * Set mem_size for direct map access properly instead of hacking. Remove off>0 check. (Alexei) * Do not allocate new memory for min_index/max_index (Alexei, Eduard) * Information required during check_cfg is now cached to be reused later (Alexei + general logic for supporting multiple JT per jump) * Properly compare registers in regsafe (Alexei, Eduard) * Remove support for JMP32 (Eduard) * Better checks in adjust_ptr_min_max_vals (Eduard) * More selftests were added (but still there's room for more) which directly use gotox (Alexei) * More checks and verbose messages added * "unique pointers" are no more in the mapLinks: 1. https://lpc.events/event/18/contributions/1941/ 2. https://lwn.net/Articles/1017439/ 3. https://github.com/llvm/llvm-project/pull/149715 4. https://github.com/llvm/llvm-project/pull/149715#issuecomment-3274833753 6. rfc: https://lore.kernel.org/bpf/20250615085943.3871208-1-a.s.protopopov@gmail.com/====================Link: https://patch.msgid.link/20251105090410.1250500-1-a.s.protopopov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c

493d9e0d608339a32f568504d5fd411a261bb0af - bpf, x86: add support for indirect jumps

Wed, 05 Nov 2025 09:04:06 +0000

bpf, x86: add support for indirect jumpsAdd support for a new instruction BPF_JMP|BPF_X|BPF_JA, SRC=0, DST=Rx, off=0, imm=0which does an indirect jump to a location stored in Rx. The registerRx should have type PTR_TO_INSN. This new type assures that the Rxregister contains a value (or a range of values) loaded from acorrect jump table – map of type instruction array.For example, for a C switch LLVM will generate the following code: 0: r3 = r1 # "switch (r3)" 1: if r3 > 0x13 goto +0x666 # check r3 boundaries 2: r3 <<= 0x3 # adjust to an index in array of addresses 3: r1 = 0xbeef ll # r1 is PTR_TO_MAP_VALUE, r1->map_ptr=M 5: r1 += r3 # r1 inherits boundaries from r3 6: r1 = *(u64 *)(r1 + 0x0) # r1 now has type INSN_TO_PTR 7: gotox r1 # jit will generate proper codeHere the gotox instruction corresponds to one particular map. This ispossible however to have a gotox instruction which can be loaded fromdifferent maps, e.g. 0: r1 &= 0x1 1: r2 <<= 0x3 2: r3 = 0x0 ll # load from map M_1 4: r3 += r2 5: if r1 == 0x0 goto +0x4 6: r1 <<= 0x3 7: r3 = 0x0 ll # load from map M_2 9: r3 += r1 A: r1 = *(u64 *)(r3 + 0x0) B: gotox r1 # jump to target loaded from M_1 or M_2During check_cfg stage the verifier will collect all the maps whichpoint to inside the subprog being verified. When building the config,the high 16 bytes of the insn_state are used, so this patch(theoretically) supports jump tables of up to 2^16 slots.During the later stage, in check_indirect_jump, it is checked thatthe register Rx was loaded from a particular instruction array.Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-9-a.s.protopopov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/bpf_insn_array.c