Message-ID: <sashiko-outbox-203981@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH bpf-next v3 08/24] arm64, insn: Reject invalid and
 unpredictable operands in the encoders
Reply-To: sashiko-reviews@lists.linux.dev
To: "Daniel Borkmann" <daniel@iogearbox.net>
Cc: bpf@vger.kernel.org
In-Reply-To: <a039fe7efc077061852c80b14b6ebcc81cdef75d.1794165614.git.daniel@iogearbox.net>
References: <cover.1794165614.git.daniel@iogearbox.net>
 <a039fe7efc077061852c80b14b6ebcc81cdef75d.1794165614.git.daniel@iogearbox.net>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Sun, 08 Nov 2026 19:38:40 +0000
Precedence: list

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] arm64, insn: s32 offset truncation in aarch64_insn_gen_adr() for
  ADRP
--

commit cecf5be8cc096127beade0ea92a07c5f62e297a6
Author: Daniel Borkmann <daniel@iogearbox.net>

arm64, insn: Reject invalid and unpredictable operands in the encoders

This commit rejects out-of-range and CONSTRAINED UNPREDICTABLE operands in
several arm64 instruction encoders so they return AARCH64_BREAK_FAULT.

> diff --git a/arch/arm64/lib/insn.c b/arch/arm64/lib/insn.c
> index 48a481aa9656c..87a06bd088115 100644
> --- a/arch/arm64/lib/insn.c
> +++ b/arch/arm64/lib/insn.c

[ ... ]

> @@ -1293,6 +1320,9 @@ u32 aarch64_insn_gen_adr(unsigned long pc, unsigned=
 long addr,
>  	switch (type) {
>  	case AARCH64_INSN_ADR_TYPE_ADR:
>  		insn =3D aarch64_insn_get_adr_value();
> +		/* The s32 offset would truncate a difference beyond 4GB */
> +		if ((long)(addr - pc) !=3D (s32)(addr - pc))
> +			return AARCH64_BREAK_FAULT;
>  		offset =3D addr - pc;
>  		break;
>  	case AARCH64_INSN_ADR_TYPE_ADRP:

[Severity: Low]
Can the AARCH64_INSN_ADR_TYPE_ADRP branch right below still truncate into
range when storing the shifted page difference into s32 offset?

arch/arm64/lib/insn.c:aarch64_insn_gen_adr() {
	u32 insn;
	s32 offset;
    ...
	case AARCH64_INSN_ADR_TYPE_ADRP:
		insn =3D aarch64_insn_get_adrp_value();
		offset =3D (addr - ALIGN_DOWN(pc, SZ_4K)) >> 12;
		break;
    ...
	if (offset < -SZ_1M || offset >=3D SZ_1M)
		return AARCH64_BREAK_FAULT;
}

When addr and pc are 16 TiB or more apart, bits [51:32] of the shifted page
offset are dropped before the [-SZ_1M, SZ_1M) range check.  Declaring offset
as long (like label_imm_common()) and casting the difference to long before
shifting in the ADRP case would avoid 32-bit truncation in both branches
without needing the separate s32 comparison.

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/cover.1794165614.gi=
t.daniel@iogearbox.net?part=3D8