diff options
Diffstat (limited to 'common/recipes-kernel/linux/linux-yocto-4.9.21/0097-bpf-fix-bpf_tail_call-x64-JIT.patch')
| -rw-r--r-- | common/recipes-kernel/linux/linux-yocto-4.9.21/0097-bpf-fix-bpf_tail_call-x64-JIT.patch | 62 |
1 files changed, 62 insertions, 0 deletions
diff --git a/common/recipes-kernel/linux/linux-yocto-4.9.21/0097-bpf-fix-bpf_tail_call-x64-JIT.patch b/common/recipes-kernel/linux/linux-yocto-4.9.21/0097-bpf-fix-bpf_tail_call-x64-JIT.patch new file mode 100644 index 00000000..3dc0c637 --- /dev/null +++ b/common/recipes-kernel/linux/linux-yocto-4.9.21/0097-bpf-fix-bpf_tail_call-x64-JIT.patch @@ -0,0 +1,62 @@ +From ecfa2d777b29f5947197dd304baf515d1ac16355 Mon Sep 17 00:00:00 2001 +From: Alexei Starovoitov <ast@fb.com> +Date: Mon, 29 Jan 2018 02:48:55 +0100 +Subject: [PATCH 097/103] bpf: fix bpf_tail_call() x64 JIT + +[ upstream commit 90caccdd8cc0215705f18b92771b449b01e2474a ] + +- bpf prog_array just like all other types of bpf array accepts 32-bit index. + Clarify that in the comment. +- fix x64 JIT of bpf_tail_call which was incorrectly loading 8 instead of 4 bytes +- tighten corresponding check in the interpreter to stay consistent + +The JIT bug can be triggered after introduction of BPF_F_NUMA_NODE flag +in commit 96eabe7a40aa in 4.14. Before that the map_flags would stay zero and +though JIT code is wrong it will check bounds correctly. +Hence two fixes tags. All other JITs don't have this problem. + +Signed-off-by: Alexei Starovoitov <ast@kernel.org> +Fixes: 96eabe7a40aa ("bpf: Allow selecting numa node during map creation") +Fixes: b52f00e6a715 ("x86: bpf_jit: implement bpf_tail_call() helper") +Acked-by: Daniel Borkmann <daniel@iogearbox.net> +Acked-by: Martin KaFai Lau <kafai@fb.com> +Reviewed-by: Eric Dumazet <edumazet@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/x86/net/bpf_jit_comp.c | 4 ++-- + kernel/bpf/core.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index ece29e2..7840331 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -278,9 +278,9 @@ static void emit_bpf_tail_call(u8 **pprog) + /* if (index >= array->map.max_entries) + * goto out; + */ +- EMIT4(0x48, 0x8B, 0x46, /* mov rax, qword ptr [rsi + 16] */ ++ EMIT2(0x89, 0xD2); /* mov edx, edx */ ++ EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */ + offsetof(struct bpf_array, map.max_entries)); +- EMIT3(0x48, 0x39, 0xD0); /* cmp rax, rdx */ + #define OFFSET1 43 /* number of bytes to jump */ + EMIT2(X86_JBE, OFFSET1); /* jbe out */ + label1 = cnt; +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index aa6d981..ab9576b 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -715,7 +715,7 @@ static unsigned int __bpf_prog_run(void *ctx, const struct bpf_insn *insn) + struct bpf_map *map = (struct bpf_map *) (unsigned long) BPF_R2; + struct bpf_array *array = container_of(map, struct bpf_array, map); + struct bpf_prog *prog; +- u64 index = BPF_R3; ++ u32 index = BPF_R3; + + if (unlikely(index >= array->map.max_entries)) + goto out; +-- +2.7.4 + |