From: Alexei Starovoitov bpf_compute_const_regs() constant-folds loads from frozen read-only maps via bpf_map_direct_read(). insn_array maps are frozen and read-only too, but their values are addresses of jitted insns that are not known during verification. bpf_map_direct_read() returns zero, the register loaded from the first two elements of a jump table becomes const 0 and bpf_prune_dead_branches() may rewrite a conditional jump on it. check_map_mem_read() in the main pass marks such register as PTR_TO_INSN. Treat it as unknown in const_fold as well. Signed-off-by: Alexei Starovoitov --- kernel/bpf/const_fold.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/bpf/const_fold.c b/kernel/bpf/const_fold.c index 7f1b30059cc8..982125026eaf 100644 --- a/kernel/bpf/const_fold.c +++ b/kernel/bpf/const_fold.c @@ -181,7 +181,12 @@ static void const_reg_xfer(struct bpf_verifier_env *env, struct const_arg_info * int off = src->val + insn->off; u64 val = 0; + /* + * Values of insn_array map are addresses of jitted instructions, + * which are not known until the program is jitted. + */ if (!bpf_map_is_rdonly(map) || !map->ops->map_direct_value_addr || + map->map_type == BPF_MAP_TYPE_INSN_ARRAY || off < 0 || off + size > map->value_size || bpf_map_direct_read(map, off, size, &val, is_ldsx)) { *dst = unknown; -- 2.55.0