lkml.org 
[lkml]   [2018]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 04/67] bpf: fix bpf_tail_call() x64 JIT
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alexei Starovoitov <ast@fb.com>

    [ upstream commit 90caccdd8cc0215705f18b92771b449b01e2474a ]

    - bpf prog_array just like all other types of bpf array accepts 32-bit index.
    Clarify that in the comment.
    - fix x64 JIT of bpf_tail_call which was incorrectly loading 8 instead of 4 bytes
    - tighten corresponding check in the interpreter to stay consistent

    The JIT bug can be triggered after introduction of BPF_F_NUMA_NODE flag
    in commit 96eabe7a40aa in 4.14. Before that the map_flags would stay zero and
    though JIT code is wrong it will check bounds correctly.
    Hence two fixes tags. All other JITs don't have this problem.

    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Fixes: 96eabe7a40aa ("bpf: Allow selecting numa node during map creation")
    Fixes: b52f00e6a715 ("x86: bpf_jit: implement bpf_tail_call() helper")
    Acked-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Martin KaFai Lau <kafai@fb.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/x86/net/bpf_jit_comp.c | 4 ++--
    kernel/bpf/core.c | 2 +-
    2 files changed, 3 insertions(+), 3 deletions(-)

    --- a/arch/x86/net/bpf_jit_comp.c
    +++ b/arch/x86/net/bpf_jit_comp.c
    @@ -266,9 +266,9 @@ static void emit_bpf_tail_call(u8 **ppro
    /* if (index >= array->map.max_entries)
    * goto out;
    */
    - EMIT4(0x48, 0x8B, 0x46, /* mov rax, qword ptr [rsi + 16] */
    + EMIT2(0x89, 0xD2); /* mov edx, edx */
    + EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */
    offsetof(struct bpf_array, map.max_entries));
    - EMIT3(0x48, 0x39, 0xD0); /* cmp rax, rdx */
    #define OFFSET1 43 /* number of bytes to jump */
    EMIT2(X86_JBE, OFFSET1); /* jbe out */
    label1 = cnt;
    --- a/kernel/bpf/core.c
    +++ b/kernel/bpf/core.c
    @@ -517,7 +517,7 @@ select_insn:
    struct bpf_map *map = (struct bpf_map *) (unsigned long) BPF_R2;
    struct bpf_array *array = container_of(map, struct bpf_array, map);
    struct bpf_prog *prog;
    - u64 index = BPF_R3;
    + u32 index = BPF_R3;

    if (unlikely(index >= array->map.max_entries))
    goto out;

    \
     
     \ /
      Last update: 2018-02-02 18:02    [W:3.662 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site