ebpf icon indicating copy to clipboard operation
ebpf copied to clipboard

`call -1` instructions no longer load without error

Open brycekahle opened this issue 4 months ago • 3 comments

Describe the bug

https://github.com/cilium/ebpf/commit/f086705551436bf5bd27d6dc0a22df8974b87ef2 breaks loading of programs with error: decoding instructions for section <sectionname>: offset <offset>: invalid constant 0xffffffff

The actual instruction looks like 85 00 00 00 ff ff ff ff call -1

This is happening because we have call -1 instructions that we use as sentinels for patching before loading into the kernel. Since 0xffff is a valid 32 bit value, it shouldn't be considered an invalid constant or instruction. I'm not sure why it is being sign-extended to 64 bits in the error message.

How to reproduce

Write an ebpf program with the following:

#define PATCH_TARGET -1
static void *(*bpf_patch)(unsigned long, ...) = (void *)PATCH_TARGET;

and in your program use it

bpf_patch(0, 0);

then try to load the program using cilium/ebpf

Version information

n/a

brycekahle avatar Jun 05 '25 23:06 brycekahle