CFG construction records the modeled gotox target set in insn_aux_data->jt. It includes INSN_ARRAY maps based on whether the map target is in the current subprog. check_indirect_jump() later validates and follows the current PTR_TO_INSN register's actual INSN_ARRAY map. The verifier does not check that targets copied from that map stay inside the same subprog as the gotox instruction. This lets one gotox instruction observe two different INSN_ARRAY maps. CFG can select a map whose target is in the current subprog. Another path to the same gotox can carry a PTR_TO_INSN value from a map whose target points at a different subprog. The verifier then accepts a cross-subprog edge that CFG construction did not allow for this gotox instruction. On x86, gotox becomes a raw indirect jump in the JIT image. Accepting a target outside the gotox subprog can enter another subprog without a matching BPF call frame and crash when executed. Validation observed a GPF in bpf_test_run(). Fix this by requiring every target copied from the actual PTR_TO_INSN map to stay within the subprog that contains the current gotox instruction. Reject the program before pushing verifier states for any cross-subprog target. Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Signed-off-by: Nuoqi Gui --- kernel/bpf/verifier.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index eb46a81a8c51..98d3fa2f162a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -17145,9 +17145,11 @@ static int indirect_jump_min_max_index(struct bpf_verifier_env *env, static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *insn) { struct bpf_verifier_state *other_branch; + struct bpf_subprog_info *subprog; struct bpf_reg_state *dst_reg; struct bpf_map *map; u32 min_index, max_index; + int subprog_start, subprog_end; int err = 0; int n; int i; @@ -17188,6 +17190,25 @@ static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *in return -EINVAL; } + subprog = bpf_find_containing_subprog(env, env->insn_idx); + if (verifier_bug_if(!subprog, env, + "gotox insn %d is outside subprog bounds\n", + env->insn_idx)) + return -EFAULT; + subprog_start = subprog->start; + subprog_end = (subprog + 1)->start; + + for (i = 0; i < n; i++) { + u32 target = env->gotox_tmp_buf->items[i]; + + if (target < subprog_start || target >= subprog_end) { + verbose(env, + "gotox target %u from map id=%d is outside subprog [%d,%d)\n", + target, map->id, subprog_start, subprog_end); + return -EINVAL; + } + } + for (i = 0; i < n - 1; i++) { mark_indirect_target(env, env->gotox_tmp_buf->items[i]); other_branch = push_stack(env, env->gotox_tmp_buf->items[i], -- 2.34.1