Merge branch 'bpf-disallow-interpreter-fallback-for-interpreter-unsupported-insns'

Leon Hwang says:

====================
bpf: Disallow interpreter fallback for interpreter-unsupported insns

Sashiko reported two potential issues about interpreter fallback [1]
[2].

After verifying them by patch #7 of v1, I think they are real issues. With
LLM assistance, the interpreter does not support the internal
BPF_PROBE_ATOMIC insn and the gotox insn (used for indirect jumps),
either.

1) the user BPF_ADDR_SPACE_CAST insn
   the interpreter just ignores it.

2) the arena ST/STX/LDX insn
   the interpreter could hit the BUG_ON() in ___bpf_prog_run().

3) the BPF_MOV64_PERCPU_REG insn
   the interpreter could hit page fault, due to loading memory from
   invalid __percpu pointer.

4) the internal BPF_PROBE_ATOMIC insn
   the interpreter could hit the BUG_ON() in ___bpf_prog_run().

5) the gotox insn used for indirect jumps
   the interpreter could hit the BUG_ON() in ___bpf_prog_run(), too.

Reject these insns on interpreter fallback path in
__bpf_prog_select_runtime() by setting 'jit_required = true'.

Link:
[1] https://lore.kernel.org/bpf/20260608151347.2C77D1F00893@smtp.kernel.org/
[2] https://lore.kernel.org/bpf/20260622150759.EC9071F000E9@smtp.kernel.org/

Changes:
v1 -> v2:
* Drop RFC.
* Change target tree to bpf-next to utilize the 'jit_required' bit.
* Set jit_required as true if there's arena map, then all arena-related
  insns will be rejected if JIT is not available.
* Set jit_required as true if there's insn_array map, then the gotox
  insns will be rejected if JIT is not available.
* Drop the issues-proven patch.
* v1: https://lore.kernel.org/bpf/20260626154330.33619-1-leon.hwang@linux.dev/
====================

Link: https://patch.msgid.link/20260715141122.15783-1-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 31181e0c2b80..d9542127dfdf 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -4163,7 +4163,7 @@ bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image)
 }
 #endif
 
-static inline bool bpf_map_supports_cpu_flags(enum bpf_map_type map_type)
+static inline bool bpf_map_is_percpu_map(enum bpf_map_type map_type)
 {
 	switch (map_type) {
 	case BPF_MAP_TYPE_PERCPU_ARRAY:
@@ -4190,7 +4190,7 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all
 		return -EINVAL;
 
 	if (flags & (BPF_F_CPU | BPF_F_ALL_CPUS)) {
-		if (!bpf_map_supports_cpu_flags(map->map_type))
+		if (!bpf_map_is_percpu_map(map->map_type))
 			return -EINVAL;
 		if ((flags & BPF_F_CPU) && (flags & BPF_F_ALL_CPUS))
 			return -EINVAL;