Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1657980

[PATCH 4.9 08/94] bpf, arm64: fix faulty emission of map access in tail calls

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>


[ Upstream commit d8b54110ee944de522ccd3531191f39986ec20f9 ]

Shubham was recently asking on netdev why in arm64 JIT we don't multiply
the index for accessing the tail call map by 8. That led me into testing
out arm64 JIT wrt tail calls and it turned out I got a NULL pointer
dereference on the tail call.

The buggy access is at:

  prog = array->ptrs[index];
  if (prog == NULL)
      goto out;

  [...]
  00000060:  d2800e0a  mov x10, #0x70 // #112
  00000064:  f86a682a  ldr x10, [x1,x10]
  00000068:  f862694b  ldr x11, [x10,x2]
  0000006c:  b40000ab  cbz x11, 0x00000080
  [...]

The code triggering the crash is f862694b. x1 at the time contains the
address of the bpf array, x10 offsetof(struct bpf_array, ptrs). Meaning,
above we load the pointer to the program at map slot 0 into x10. x10
can then be NULL if the slot is not occupied, which we later on try to
access with a user given offset in x2 that is the map index.

Fix this by emitting the following instead:

  [...]
  00000060:  d2800e0a  mov x10, #0x70 // #112
  00000064:  8b0a002a  add x10, x1, x10
  00000068:  d37df04b  lsl x11, x2, #3
  0000006c:  f86b694b  ldr x11, [x10,x11]
  00000070:  b40000ab  cbz x11, 0x00000084
  [...]

This basically adds the offset to ptrs to the base address of the bpf
array we got and we later on access the map with an index * 8 offset
relative to that. The tail call map itself is basically one large area
with meta data at the head followed by the array of prog pointers.
This makes tail calls working again, tested on Cavium ThunderX ARMv8.

Fixes: ddb55992b04d ("arm64: bpf: implement bpf_tail_call() helper")
Reported-by: Shubham Bansal <illusionist.neo@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/net/bpf_jit_comp.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -252,8 +252,9 @@ static int emit_bpf_tail_call(struct jit
 	 */
 	off = offsetof(struct bpf_array, ptrs);
 	emit_a64_mov_i64(tmp, off, ctx);
-	emit(A64_LDR64(tmp, r2, tmp), ctx);
-	emit(A64_LDR64(prg, tmp, r3), ctx);
+	emit(A64_ADD(1, tmp, r2, tmp), ctx);
+	emit(A64_LSL(1, prg, r3, 3), ctx);
+	emit(A64_LDR64(prg, tmp, prg), ctx);
 	emit(A64_CBZ(1, prg, jmp_offset), ctx);
 
 	/* goto *(prog->bpf_func + prologue_size); */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/94] 4.9.31-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 14/94] net/packet: fix missing net_device reference release Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 05/94] s390/qeth: unbreak OSM and OSN support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 18/94] net: Improve handling of failures on link and route dumps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 15/94] net/mlx5e: Use the correct pause values for ethtool advertising Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 30/94] virtio-net: enable TSO/checksum offloads for Q-in-Q vlans Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 08/94] bpf, arm64: fix faulty emission of map access in tail calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 29/94] be2net: Fix offload features for Q-in-Q packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 16/94] net/mlx5e: Fix ethtool pause support and advertise reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 13/94] sctp: do not inherit ipv6_{mc|ac|fl}_list from parent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 17/94] tcp: eliminate negative reordering in tcp_clean_rtx_queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 06/94] s390/qeth: avoid null pointer dereference on OSN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 20/94] ipv6: Check ip6_find_1stfragopt() return value properly. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  [PATCH 4.9 12/94] sctp: fix src address selection if using secondary addresses for ipv6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:20 +0200
  Re: [PATCH 4.9 00/94] 4.9.31-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-05 22:40 +0200
  Re: [PATCH 4.9 00/94] 4.9.31-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-06 00:30 +0200

csiph-web