From patchwork Tue Sep 29 11:01:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 263181 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 482A7C47423 for ; Tue, 29 Sep 2020 11:56:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 04065206DB for ; Tue, 29 Sep 2020 11:56:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601380575; bh=/lT7H3OXzxcu3Vz67CeNXX/b3kJ+nN8VHCCoEPiHmxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=nm7EvYMFdtV2CglzKtfx+TUzk25HtrMJldOHAcjd8VU3A+oBlAYuyf4Gg0tn/gcuW bLUfnavSxdqo8BLfdNAx01m9LmUIQaY3Djj4TPmHa/vAy1wvqzuWoQK0so8F5KLBbn flNQCiTfnDnMsqw+iyQgk006bwEeRLaFMvhOFG4I= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728570AbgI2L4O (ORCPT ); Tue, 29 Sep 2020 07:56:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:43140 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730853AbgI2LoQ (ORCPT ); Tue, 29 Sep 2020 07:44:16 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 83A10206F7; Tue, 29 Sep 2020 11:44:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601379856; bh=/lT7H3OXzxcu3Vz67CeNXX/b3kJ+nN8VHCCoEPiHmxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZbHo8mREAMUo/+5hMi5PTGtSrOlY1uP1QWtkK/704KAobd8gnMw2Kjwsfd7iK+kzr 1dcid+4xPYmlaadQPjUvtrHASKnOFLwBQe3Zq+DR4yVmdVW74RTQHHJeXVY7A/nKxD VP7BTUDXLmGsAMAjTQZp2+UfjGWGscWy+DFgLZXQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bryce Kahle , Daniel Borkmann , Alexei Starovoitov , Sasha Levin Subject: [PATCH 5.4 346/388] bpf: Fix clobbering of r2 in bpf_gen_ld_abs Date: Tue, 29 Sep 2020 13:01:17 +0200 Message-Id: <20200929110027.210377484@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200929110010.467764689@linuxfoundation.org> References: <20200929110010.467764689@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Daniel Borkmann [ Upstream commit e6a18d36118bea3bf497c9df4d9988b6df120689 ] Bryce reported that he saw the following with: 0: r6 = r1 1: r1 = 12 2: r0 = *(u16 *)skb[r1] The xlated sequence was incorrectly clobbering r2 with pointer value of r6 ... 0: (bf) r6 = r1 1: (b7) r1 = 12 2: (bf) r1 = r6 3: (bf) r2 = r1 4: (85) call bpf_skb_load_helper_16_no_cache#7692160 ... and hence call to the load helper never succeeded given the offset was too high. Fix it by reordering the load of r6 to r1. Other than that the insn has similar calling convention than BPF helpers, that is, r0 - r5 are scratch regs, so nothing else affected after the insn. Fixes: e0cea7ce988c ("bpf: implement ld_abs/ld_ind in native bpf") Reported-by: Bryce Kahle Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/cace836e4d07bb63b1a53e49c5dfb238a040c298.1599512096.git.daniel@iogearbox.net Signed-off-by: Sasha Levin --- net/core/filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index cf2a68513bfd5..c441f9961e917 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -6791,8 +6791,6 @@ static int bpf_gen_ld_abs(const struct bpf_insn *orig, bool indirect = BPF_MODE(orig->code) == BPF_IND; struct bpf_insn *insn = insn_buf; - /* We're guaranteed here that CTX is in R6. */ - *insn++ = BPF_MOV64_REG(BPF_REG_1, BPF_REG_CTX); if (!indirect) { *insn++ = BPF_MOV64_IMM(BPF_REG_2, orig->imm); } else { @@ -6800,6 +6798,8 @@ static int bpf_gen_ld_abs(const struct bpf_insn *orig, if (orig->imm) *insn++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, orig->imm); } + /* We're guaranteed here that CTX is in R6. */ + *insn++ = BPF_MOV64_REG(BPF_REG_1, BPF_REG_CTX); switch (BPF_SIZE(orig->code)) { case BPF_B: