adjust_subprog_starts_after_remove() compacts subprog_info[] and the func_info when whole subprograms are removed as dead code, but leaves env->exception_callback_subprog alone, so an exception callback declared through the exception_callback decl tag which sits behind a removed subprogram keeps its old index. jit_subprogs() then takes the exception callback from func[] at that index, which is past the end when the callback was the last subprogram, or another subprogram otherwise. Rebase the index along with the entries it refers to. Fixes: b9ae0c9dd0ac ("bpf: Add support for custom exception callbacks") Signed-off-by: Daniel Borkmann --- kernel/bpf/fixups.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c index e9c2d6c06218..d49c50dae20a 100644 --- a/kernel/bpf/fixups.c +++ b/kernel/bpf/fixups.c @@ -506,6 +506,9 @@ static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env, * in adjust_btf_func() - no need to adjust */ } + /* The exception callback is live, so it cannot sit inside the removed range. */ + if (env->exception_callback_subprog >= j) + env->exception_callback_subprog -= j - i; } else { /* convert i from "first prog to remove" to "first to adjust" */ if (env->subprog_info[i].start == off) -- 2.43.0