| Message ID | 1446698639-12362-1-git-send-email-zlim.lnx@gmail.com |
|---|---|
| State | Accepted |
| Commit | 14e589ff4aa3f28a5424e92b6495ecb8950080f7 |
| Headers | show |
On Wed, Nov 04, 2015 at 08:43:59PM -0800, Zi Shen Lim wrote: > Turns out in the case of modulo by zero in a BPF program: > A = A % X; (X == 0) > the expected behavior is to terminate with return value 0. > > The bug in JIT is exposed by a new test case [1]. > > [1] https://lkml.org/lkml/2015/11/4/499 > > Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com> > Reported-by: Yang Shi <yang.shi@linaro.org> > Reported-by: Xi Wang <xi.wang@gmail.com> > CC: Alexei Starovoitov <ast@plumgrid.com> > CC: Catalin Marinas <catalin.marinas@arm.com> > Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler") > Cc: <stable@vger.kernel.org> # 3.18+ > --- > This patch applies on top of "arm64: bpf: fix fiv-by-zero case" [2]. Both patches applied. Thanks. -- Catalin -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 9ae6f23..6217f80 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -269,6 +269,8 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) break; case BPF_ALU | BPF_DIV | BPF_X: case BPF_ALU64 | BPF_DIV | BPF_X: + case BPF_ALU | BPF_MOD | BPF_X: + case BPF_ALU64 | BPF_MOD | BPF_X: { const u8 r0 = bpf2a64[BPF_REG_0]; @@ -281,16 +283,19 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) check_imm26(jmp_offset); emit(A64_B(jmp_offset), ctx); /* else */ - emit(A64_UDIV(is64, dst, dst, src), ctx); + switch (BPF_OP(code)) { + case BPF_DIV: + emit(A64_UDIV(is64, dst, dst, src), ctx); + break; + case BPF_MOD: + ctx->tmp_used = 1; + emit(A64_UDIV(is64, tmp, dst, src), ctx); + emit(A64_MUL(is64, tmp, tmp, src), ctx); + emit(A64_SUB(is64, dst, dst, tmp), ctx); + break; + } break; } - case BPF_ALU | BPF_MOD | BPF_X: - case BPF_ALU64 | BPF_MOD | BPF_X: - ctx->tmp_used = 1; - emit(A64_UDIV(is64, tmp, dst, src), ctx); - emit(A64_MUL(is64, tmp, tmp, src), ctx); - emit(A64_SUB(is64, dst, dst, tmp), ctx); - break; case BPF_ALU | BPF_LSH | BPF_X: case BPF_ALU64 | BPF_LSH | BPF_X: emit(A64_LSLV(is64, dst, dst, src), ctx);
Turns out in the case of modulo by zero in a BPF program: A = A % X; (X == 0) the expected behavior is to terminate with return value 0. The bug in JIT is exposed by a new test case [1]. [1] https://lkml.org/lkml/2015/11/4/499 Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com> Reported-by: Yang Shi <yang.shi@linaro.org> Reported-by: Xi Wang <xi.wang@gmail.com> CC: Alexei Starovoitov <ast@plumgrid.com> CC: Catalin Marinas <catalin.marinas@arm.com> Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler") Cc: <stable@vger.kernel.org> # 3.18+ --- This patch applies on top of "arm64: bpf: fix fiv-by-zero case" [2]. [2] https://lkml.org/lkml/2015/11/4/25 arch/arm64/net/bpf_jit_comp.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html