linux-kernel - Re: [PATCH] BPF : arch/x86/net/bpf_jit_comp.c : fix wrong condition code in jit compiler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <eebea88a-ebef-4bc7-9859-52820113318d@iogearbox.net>
Date: Wed, 25 Sep 2024 14:37:42 +0200
From: Daniel Borkmann <daniel@...earbox.net>
To: zyf <zhouyangfan20s@....ac.cn>, bpf@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, netdev@...r.kernel.org, dsahern@...nel.org,
 Yonghong Song <yonghong.song@...ux.dev>
Subject: Re: [PATCH] BPF : arch/x86/net/bpf_jit_comp.c : fix wrong condition
 code in jit compiler

On 9/25/24 10:23 AM, zyf wrote:
> change 'case BPF_ALU64 | BPF_END | BPF_FROM_LE' to 'case BPF_ALU64 | BPF_END | BPF_FROM_BE'
>
> Signed-off-by: zyf <zhouyangfan20s@....ac.cn>
> ---
>   arch/x86/net/bpf_jit_comp.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index 06b080b61aa5..7f954d76b3a6 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
> @@ -1786,7 +1786,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, u8 *rw_image
>   			break;
>   
>   		case BPF_ALU | BPF_END | BPF_FROM_BE:
> -		case BPF_ALU64 | BPF_END | BPF_FROM_LE:
> +		case BPF_ALU64 | BPF_END | BPF_FROM_BE:
>   			switch (imm32) {
>   			case 16:
>   				/* Emit 'ror %ax, 8' to swap lower 2 bytes */
Please elaborate on the exact issue you've encountered. Right now it looks
like you did this change just based on code review but not based on a real
world bug?

BPF_ALU64 | BPF_END | BPF_FROM_LE instruction is unconditonal swap,
see also commit 0845c3db7bf5c4ceb ("bpf: Support new unconditional bswap 
instruction").
As it stands your change additionally breaks BPF selftests.