linux/arch/arm64
Puranjay Mohan 114b5b3b4b bpf, arm64: fix bug in BPF_LDX_MEMSX
A64_LDRSW() takes three registers: Xt, Xn, Xm as arguments and it loads
and sign extends the value at address Xn + Xm into register Xt.

Currently, the offset is being directly used in place of the tmp
register which has the offset already loaded by the last emitted
instruction.

This will cause JIT failures. The easiest way to reproduce this is to
test the following code through test_bpf module:

{
	"BPF_LDX_MEMSX | BPF_W",
	.u.insns_int = {
		BPF_LD_IMM64(R1, 0x00000000deadbeefULL),
		BPF_LD_IMM64(R2, 0xffffffffdeadbeefULL),
		BPF_STX_MEM(BPF_DW, R10, R1, -7),
		BPF_LDX_MEMSX(BPF_W, R0, R10, -7),
		BPF_JMP_REG(BPF_JNE, R0, R2, 1),
		BPF_ALU64_IMM(BPF_MOV, R0, 0),
		BPF_EXIT_INSN(),
	},
	INTERNAL,
	{ },
	{ { 0, 0 } },
	.stack_depth = 7,
},

We need to use the offset as -7 to trigger this code path, there could
be other valid ways to trigger this from proper BPF programs as well.

This code is rejected by the JIT because -7 is passed to A64_LDRSW() but
it expects a valid register (0 - 31).

 roott@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W"
 [11300.490371] test_bpf: test_bpf: set 'test_bpf' as the default test_suite.
 [11300.491750] test_bpf: #345 BPF_LDX_MEMSX | BPF_W
 [11300.493179] aarch64_insn_encode_register: unknown register encoding -7
 [11300.494133] aarch64_insn_encode_register: unknown register encoding -7
 [11300.495292] FAIL to select_runtime err=-524
 [11300.496804] test_bpf: Summary: 0 PASSED, 1 FAILED, [0/0 JIT'ed]
 modprobe: ERROR: could not insert 'test_bpf': Invalid argument

Applying this patch fixes the issue.

 root@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W"
 [  292.837436] test_bpf: test_bpf: set 'test_bpf' as the default test_suite.
 [  292.839416] test_bpf: #345 BPF_LDX_MEMSX | BPF_W jited:1 156 PASS
 [  292.844794] test_bpf: Summary: 1 PASSED, 0 FAILED, [1/1 JIT'ed]

Fixes: cc88f540da ("bpf, arm64: Support sign-extension load instructions")
Signed-off-by: Puranjay Mohan <puranjay12@gmail.com>
Message-ID: <20240312235917.103626-1-puranjay12@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2024-03-19 22:55:19 -07:00
..
boot SoC: device tree updates for 6.9 2024-03-12 10:29:57 -07:00
configs pstore updates for v6.9-rc1 2024-03-12 14:36:18 -07:00
crypto crypto: arm64/neonbs - fix out-of-bounds access on short input 2024-02-24 08:37:24 +08:00
hyperv
include Networking changes for 6.9. 2024-03-12 17:44:08 -07:00
kernel Networking changes for 6.9. 2024-03-12 17:44:08 -07:00
kvm KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler 2024-02-21 10:06:41 +00:00
lib arm64: Get rid of ARM64_HAS_NO_HW_PREFETCH 2023-12-05 12:02:52 +00:00
mm IOMMU Updates for Linux v6.8 2024-01-18 15:16:57 -08:00
net bpf, arm64: fix bug in BPF_LDX_MEMSX 2024-03-19 22:55:19 -07:00
tools arm64: Rename ARM64_WORKAROUND_2966298 2024-01-12 12:51:33 +00:00
xen
Kbuild
Kconfig hardening updates for v6.9-rc1 2024-03-12 14:49:30 -07:00
Kconfig.debug
Kconfig.platforms
Makefile arm64: vdso32: Remove unused vdso32-offsets.h 2024-01-30 11:59:17 +00:00