netdev - [PATCH] bpf, arm64: use emit_addr_mov_i64() for BPF_PSEUDO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 31 Dec 2021 23:10:18 +0800
From:   Hou Tao <houtao1@...wei.com>
To:     Alexei Starovoitov <ast@...nel.org>
CC:     Martin KaFai Lau <kafai@...com>, Yonghong Song <yhs@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Zi Shen Lim <zlim.lnx@...il.com>,
        Will Deacon <will@...nel.org>, <netdev@...r.kernel.org>,
        <bpf@...r.kernel.org>, <linux-arm-kernel@...ts.infradead.org>,
        <houtao1@...wei.com>
Subject: [PATCH] bpf, arm64: use emit_addr_mov_i64() for BPF_PSEUDO_FUNC

The following error is reported when running "./test_progs -t for_each"
under arm64:

    bpf_jit: multi-func JIT bug 58 != 56
    ......
    JIT doesn't support bpf-to-bpf calls

The root cause is the size of BPF_PSEUDO_FUNC instruction increases
from 2 to 3 after the address of called bpf-function is settled and
there are two bpf-to-bpf calls in test_pkt_access. The generated
instructions are shown below:

>before callback_fn is jited, its addr is 0x1-00000001
0x48:  21 00 C0 D2    movz x1, #0x1, lsl #32
0x4c:  21 00 80 F2    movk x1, #0x1

>after callback_fn is jited, its addr is 0xfffffe0017f2fb84
0x48:  E1 3F C0 92    movn x1, #0x1ff, lsl #32
0x4c:  41 FE A2 F2    movk x1, #0x17f2, lsl #16
0x50:  81 70 9F F2    movk x1, #0xfb84

Fixing it by using emit_addr_mov_i64() for BPF_PSEUDO_FUNC, so
the size of jited image will not change.

Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Signed-off-by: Hou Tao <houtao1@...wei.com>
---
 arch/arm64/net/bpf_jit_comp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index f81e71f6e8bf..acfc3d4d712c 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -792,7 +792,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
 		u64 imm64;
 
 		imm64 = (u64)insn1.imm << 32 | (u32)imm;
-		emit_a64_mov_i64(dst, imm64, ctx);
+		if (bpf_pseudo_func(insn))
+			emit_addr_mov_i64(dst, imm64, ctx);
+		else
+			emit_a64_mov_i64(dst, imm64, ctx);
 
 		return 1;
 	}
-- 
2.27.0