From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f48.google.com (mail-qv1-f48.google.com [209.85.219.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A21D0376A1B for ; Wed, 8 Jul 2026 02:57:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783479481; cv=none; b=V/DHbyMXgpO5hMIuEbpNzc7Ibvw5BSIZFlr2pwwJ/16t7a6MOwEIGOHFOi8DJ1W1LgXwoUuEtDm76xw8aiIzIisesePrGFMK9T9MrYsX17TSxamJY4+oobBUYBXzFR+S/YPAUWhYk7nzcqEeJTF4k1S+eaEJa7xrUm52r7mwveE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783479481; c=relaxed/simple; bh=3j56XRit/D5wuYL8ciIptQ9YfsZGFgj9aMucYagHQRI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=knNsC055FFe2HYP0mXMAE3A53n+DJKUAPszM6RbnwNomzPayP7NBpn6G7pfOSi6F67DqPvOAyp0awon49Dpq4zHZsahPFj94m00hjfRtUZvF5JSyUo4gnIKSZp8BUy6Wh6eCKrpYyKRnCxFmDg6IiR1UfmLpxB3ZD2qNIH/+7sM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=U34DRz1Q; arc=none smtp.client-ip=209.85.219.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="U34DRz1Q" Received: by mail-qv1-f48.google.com with SMTP id 6a1803df08f44-8efec2c28f8so1566006d6.2 for ; Tue, 07 Jul 2026 19:57:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783479477; x=1784084277; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=kWZHyi+T+vyeURiAwf3NckMe8YMnDEn+Lis3dCslKy4=; b=U34DRz1QfXj7RcCG52IOUrymL1jAB3ILopNIj+nROKyIhEGMDX46eXxeLSUicoLIl+ aRdR8bB75PNgtoNdXjf5d3ehc328hr8BZKhc72T2wEuFsRwnTxWiy7uReqxJdVJzqjsp JkVZm4Sj3jU57kX2rcfPZ1IYflWkwF2mRUpwTySAKmaIC4+KilJaf416Uc4gVN1ioHX4 G0Rb/D20ZWjTtEX5iJNmlac7LswQP7PRMhu2BboK7Jk7scHXmM50Zrxubx3hHJ1MZrQd nrC6qiAPSuO2NQX0ALIQ692UX55WMOaMYYR0arifSEsvYsD84HI5aYJ8sfGSlE4GmzRj Otig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783479477; x=1784084277; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kWZHyi+T+vyeURiAwf3NckMe8YMnDEn+Lis3dCslKy4=; b=A8GiryAfOc75fN9yVGdzacgKjHRNsgO1k5qKIiF/P909HWp6ERcNJDKPCBacSzooqs t6V+XjdgVvjcBMrgjmxoT9aCvlRLiAQJJ8z2aW51OsD829pAgmrFDyUCclxZBXW6t9Fv GO5Qnvmsrp1+i4RgDb8ZHR/Cka1j6OzNkQJGgaAATjc66Ln6YsgmweToTVG1khHeKgbu fyJr50PErQabpDr+pG3tbjY7A98v9nESY5Dg56ed/k7Yt+5jYHGfKQD46qjPvV+NToAa 3pkSR1cT32jqI3YLvSfuZRz4DP09s112kUGMWIDeG8670g9L38PmPpDeuNRvcbhJz2T0 EHPw== X-Forwarded-Encrypted: i=1; AHgh+RqoH2lKMXdjvU0cY7POFspj9R+D4yDuGMQAjHnhjkbt9O4O2kwYAbpvecKVIhTMAJH9hbcZrfhVT/5hMtU=@vger.kernel.org X-Gm-Message-State: AOJu0YyNJj6uUJ65wH3751hyHNGYIY1Ub65V/Tl8RPYXgYTVEuEACbgA qntSaSrClB+6hB00rt5GVtdX9Kq83QEIGUTWFOYppjddamRn20GjwnsW X-Gm-Gg: AfdE7clLGxei+kYVKViHD57z2zT7+zCs1Ej1ctAldVd0/9nrDSAnFsz+Isd0sI0Nv2J lKojnaGCwZpLz9HT8rmrKXlJf7Mx+CPOAxMaTqOCDKf58qj9rSOQVCXjTxEZ91UcC+EeOdgLFNN THg0hsYi5UyLQQkbDrjQ/EjopUDqlUXfzLVrC6MO9K6Pi1oXw8pzl6354S/pJ7TganXEeM/Q8tt yM8K/WCPwj0BCwMYUG4qb6c2YCyY3x0WIFyhTe9Sj/aokJ1kzuNiJH9rseTkEqDuRH1VUzdtWS2 iB1p0M7NhDGkE8nBbToGG0aVHgVPf8iyAcysUUF/wXQP8+e0s9IyOyIDZdGeCPT+yY6//b676/x mzLh2/m8RLwmKC+FDUk/eo0Z48oZ7aTYax1iz3Hq735en7ZaLJD2PE6AUj672wXM0l4W+oD2LLc L4QNQ2VuiqM9NXmvFCsS9PyQPuShH4wSQ2pEAyG39QUQtM2zHIrE0Wm0jFBhw+LYsN0PaMiOivg OB6KnTSUfJZEJ8= X-Received: by 2002:a0c:f405:0:b0:8fd:6de3:dd8b with SMTP id 6a1803df08f44-8fec3bf69e6mr4016686d6.65.1783479477529; Tue, 07 Jul 2026 19:57:57 -0700 (PDT) Received: from battery.lan (pool-138-88-31-60.washdc.fios.verizon.net. [138.88.31.60]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8f471de83f8sm175762936d6.33.2026.07.07.19.57.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 19:57:57 -0700 (PDT) From: David Windsor To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H . Peter Anvin" , "David S . Miller" , Jakub Kicinski , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Shuah Khan , Peter Zijlstra , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, David Windsor Subject: [PATCH bpf 1/2] bpf, x86: Fix FineIBT #CP in BPF dispatcher's indirect-jump fallback Date: Tue, 7 Jul 2026 22:57:55 -0400 Message-ID: X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit commit 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call") updated emit_cfi() to emit FineIBT preambles for JIT-compiled BPF programs, but did not update emit_bpf_dispatcher(). When prog->bpf_func is not in the dispatcher table (e.g. an XDP_REDIRECT target program in a CPUMAP or DEVMAP, or BPF_PROG_TEST_RUN of an unattached prog), the dispatcher still jumps directly to prog->bpf_func. Without a FineIBT caller sequence, under FineIBT this raises #CP: Missing ENDBR: __cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10 ------------[ cut here ]------------ kernel BUG at arch/x86/kernel/cet.c:133! Oops: invalid opcode: 0000 [#1] SMP NOPTI Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:do_kernel_cp_fault+0x126/0x130 Call Trace: exc_control_protection+0x46/0x80 asm_exc_control_protection+0x2b/0x30 RIP: 0010:__cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10 bpf_prog_test_run+0xda/0x1b0 __sys_bpf+0x70b/0x990 __x64_sys_bpf+0x2d/0x50 x64_sys_call+0x1079/0x2d40 do_syscall_64+0x12a/0x3c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e To fix this, we precede the indirect jump in emit_bpf_dispatcher() with the FineIBT caller sequence: load cfi_bpf_hash into %eax and subtract cfi_get_offset() from the target so it enters the preamble's real ENDBR. Only needed for CFI_FINEIBT. Fixes: 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call") Cc: stable@vger.kernel.org Signed-off-by: David Windsor --- arch/x86/net/bpf_jit_comp.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index de7515ea1bea..1c8249d8ca3b 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -3740,6 +3740,15 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs, u8 *image, if (err) return err; + /* If running under FineIBT, enter the preamble so the following + * indirect jump lands on a real ENDBR instead of the poison. + */ + if (cfi_mode == CFI_FINEIBT) { + EMIT1_off32(0xb8, cfi_bpf_hash); /* mov $cfi_bpf_hash, %eax */ + EMIT1(add_1mod(0x48, BPF_REG_3)); /* sub rdx, cfi_get_offset() */ + EMIT2_off32(0x81, add_1reg(0xE8, BPF_REG_3), cfi_get_offset()); + } + emit_indirect_jump(&prog, BPF_REG_3 /* R3 -> rdx */, image + (prog - buf)); *pprog = prog; -- 2.53.0