iovisor/ubpf

uBPF interpreter has incorrect behavior for jump with immediate values > 0x7fffffff

Closed this issue · 2 comments

The x64 ISA sign extends immediate values, but uBPF assumes immediate values are not sign extended.

Incorrect:
https://www.ietf.org/archive/id/draft-ietf-bpf-isa-00.html#section-2-5.2.1

Immediate values are signed integers, so presumably sign extending it is correct?

The JIT behavior matches Linux, the interpreter does not.