From nobody Tue Feb 10 21:41:30 2026 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E48437C0E0; Wed, 14 Jan 2026 09:19:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768382381; cv=none; b=OixZxogYafg643UcGIMOEo1tI1V2Ms6hLKjYbyw7rTXw/e/pHmEHdGyBxnD9p8I/EZtfYlNVMZd/fj6KeC0yzFvVG0Tk5BdjnxBCdgTby72br32t2Ulz4U9n41Sr1WrmpPbJPOAgRcMfJuRhwyMsmcKQMJckSfXwKVA5PNbsDTE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768382381; c=relaxed/simple; bh=oLsXdY04CoiXcBqZThcQMcc0g9wxqZYX1RhhefWKYMQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GNpgT8mjQEix1ja9fFSKJLVpBvQGmmVO7jBAXLsv31aFJfFC3upmY3yuns0N7GqXLGWS3KiaUWCfJ60BJ79Y9pbFPxtDKtOA6E1M+eu41mApioTEw2ZJ9n7OeB4/pZFPIuLua88VYqC1NnS5O9WLVHxkMH1HnkXKlb6uvIcAH+I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.198]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4drgXG36N7zKHMg2; Wed, 14 Jan 2026 17:18:38 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.75]) by mail.maildlp.com (Postfix) with ESMTP id 0DC8040577; Wed, 14 Jan 2026 17:19:30 +0800 (CST) Received: from k01.k01 (unknown [10.67.174.197]) by APP2 (Coremail) with SMTP id Syh0CgCXsYCfX2dpDhLdDg--.16789S3; Wed, 14 Jan 2026 17:19:29 +0800 (CST) From: Xu Kuohai To: bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Yonghong Song , Puranjay Mohan , Anton Protopopov Subject: [PATCH bpf-next v4 1/4] bpf: Fix an off-by-one error in check_indirect_jump Date: Wed, 14 Jan 2026 17:39:11 +0800 Message-ID: <20260114093914.2403982-2-xukuohai@huaweicloud.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260114093914.2403982-1-xukuohai@huaweicloud.com> References: <20260114093914.2403982-1-xukuohai@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: Syh0CgCXsYCfX2dpDhLdDg--.16789S3 X-Coremail-Antispam: 1UD129KBjvdXoWruFy3tw4UXry8tFyxAFy3twb_yoWfXrc_G3 yrXw4DWws3CF4fZF13Aa47Wa4j9rnYgFy0kr12gryDJryqq34v9r95GF95ZryDJFZrAFZx CrZxWrZ0qr1fZjkaLaAFLSUrUUUUbb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbvkYFVCjjxCrM7AC8VAFwI0_Xr0_Wr1l1xkIjI8I6I8E6xAIw20E Y4v20xvaj40_Wr0E3s1l1IIY67AEw4v_Jr0_Jr4l82xGYIkIc2x26280x7IE14v26r18M2 8IrcIa0xkI8VCY1x0267AKxVW8JVW5JwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK 021l84ACjcxK6xIIjxv20xvE14v26F1j6w1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r 4UJVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_ GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx 0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWU JVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxwCY1x0262kKe7AKxV WUtVW8ZwCY1x0264kExVAvwVAq07x20xyl42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Y z7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zV AF1VAY17CE14v26r1q6r43MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4l IxAIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCw CI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnI WIevJa73UjIFyTuYvjxUI2-eUUUUU X-CM-SenderInfo: 50xn30hkdlqx5xdzvxpfor3voofrz/ Content-Type: text/plain; charset="utf-8" From: Xu Kuohai Fix an off-by-one error in check_indirect_jump() that skips the last element returned by copy_insn_array_uniq(). Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Signed-off-by: Xu Kuohai --- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index faa1ecc1fe9d..22605d9e0ffa 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -20336,7 +20336,7 @@ static int check_indirect_jump(struct bpf_verifier_= env *env, struct bpf_insn *in return -EINVAL; } =20 - for (i =3D 0; i < n - 1; i++) { + for (i =3D 0; i < n; i++) { other_branch =3D push_stack(env, env->gotox_tmp_buf->items[i], env->insn_idx, env->cur_state->speculative); if (IS_ERR(other_branch)) --=20 2.47.3