linux-kernel - Re: [PATCH] LoongArch: BPF: Fix sign extension for 12-bit immediates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251229150619.0000195f@linux.dev>
Date: Mon, 29 Dec 2025 15:06:19 +0800
From: George Guo <dongtai.guo@...ux.dev>
To: Xi Ruoyao <xry111@...111.site>
Cc: Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann
 <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, Martin KaFai
 Lau <martin.lau@...ux.dev>, Eduard Zingerman	 <eddyz87@...il.com>, Song Liu
 <song@...nel.org>, Yonghong Song	 <yonghong.song@...ux.dev>, John Fastabend
 <john.fastabend@...il.com>, KP Singh	 <kpsingh@...nel.org>, Stanislav
 Fomichev <sdf@...ichev.me>, Hao Luo	 <haoluo@...gle.com>, Jiri Olsa
 <jolsa@...nel.org>, Tiezhu Yang	 <yangtiezhu@...ngson.cn>, Hengqi Chen
 <hengqi.chen@...il.com>, Huacai Chen	 <chenhuacai@...nel.org>, WANG Xuerui
 <kernel@...0n.name>, Youling Tang	 <tangyouling@...ngson.cn>,
 bpf@...r.kernel.org, loongarch@...ts.linux.dev,
 linux-kernel@...r.kernel.org, George Guo <guodongtai@...inos.cn>, Bing
 Huang	 <huangbing@...inos.cn>
Subject: Re: [PATCH] LoongArch: BPF: Fix sign extension for 12-bit
 immediates

On Fri, 19 Dec 2025 17:33:17 +0800
Xi Ruoyao <xry111@...111.site> wrote:

> On Mon, 2025-11-03 at 16:42 +0800, george wrote:
> > From: George Guo <guodongtai@...inos.cn>
> > 
> > When loading immediate values that fit within 12-bit signed range,
> > the move_imm function incorrectly used zero extension instead of
> > sign extension.
> > 
> > The bug was exposed when scx_simple scheduler failed with -EINVAL
> > in ops.init() after passing node = -1 to scx_bpf_create_dsq().
> > Due to incorrect sign extension, `node >= (int)nr_node_ids`
> > evaluated to true instead of false, causing BPF program failure.
> > 
> > Verified by testing with the scx_simple scheduler (located in
> > tools/sched_ext/). After building with `make` and running
> > ./tools/sched_ext/build/bin/scx_simple, the scheduler now
> > initializes successfully with this fix.
> > 
> > Fix this by using sign extension (sext) instead of zero extension
> > for signed immediate values in move_imm.
> > 
> > Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support")
> > Reported-by: Bing Huang <huangbing@...inos.cn>
> > Signed-off-by: George Guo <guodongtai@...inos.cn>
> > ---
> > Signed-off-by: george <dongtai.guo@...ux.dev>
> > ---
> >  arch/loongarch/net/bpf_jit.h | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/loongarch/net/bpf_jit.h
> > b/arch/loongarch/net/bpf_jit.h index
> > 5697158fd1645fdc3d83f598b00a9e20dfaa8f6d..f1398eb135b69ae61a27ed81f80b4bb0788cf0a0
> > 100644 --- a/arch/loongarch/net/bpf_jit.h +++
> > b/arch/loongarch/net/bpf_jit.h @@ -122,7 +122,8 @@ static inline
> > void move_imm(struct jit_ctx *ctx, enum loongarch_gpr rd, long imm
> > /* addiw rd, $zero, imm_11_0 */ if (is_signed_imm12(imm)) {
> >  		emit_insn(ctx, addiw, rd, LOONGARCH_GPR_ZERO, imm);
> > -		goto zext;
> > +		emit_sext_32(ctx, rd, is32);  
> 
> The addi.w instruction already produces the sign-extended value.  Why
> do we need to sign-extend it again?
> 
Hi Ruoyao,
I tried, it's not easy to do that. 
It's better merge this patch, then consider next step.

Thanks!