commit 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call") updated
emit_cfi() to emit FineIBT preambles for JIT-compiled BPF programs, but
did not update emit_bpf_dispatcher(). When prog->bpf_func is not in the
dispatcher table (e.g. an XDP_REDIRECT target program in a CPUMAP or
DEVMAP, or BPF_PROG_TEST_RUN of an unattached prog), the dispatcher
still jumps directly to prog->bpf_func. Without a FineIBT caller
sequence, under FineIBT this raises #CP:
Missing ENDBR: __cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10
------------[ cut here ]------------
kernel BUG at arch/x86/kernel/cet.c:133!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
RIP: 0010:do_kernel_cp_fault+0x126/0x130
Call Trace:
<TASK>
exc_control_protection+0x46/0x80
asm_exc_control_protection+0x2b/0x30
RIP: 0010:__cfi_bpf_prog_..._xdp_dispatcher_unattached+0x10/0x10
bpf_prog_test_run+0xda/0x1b0
__sys_bpf+0x70b/0x990
__x64_sys_bpf+0x2d/0x50
x64_sys_call+0x1079/0x2d40
do_syscall_64+0x12a/0x3c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
To fix this, we precede the indirect jump in emit_bpf_dispatcher() with
the FineIBT caller sequence: load cfi_bpf_hash into %eax and subtract
cfi_get_offset() from the target so it enters the preamble's real ENDBR.
Only needed for CFI_FINEIBT.
Fixes: 4f9087f16651 ("x86/cfi,bpf: Fix BPF JIT call")
Cc: [email protected]
Signed-off-by: David Windsor <[email protected]>
---
arch/x86/net/bpf_jit_comp.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index de7515ea1bea..1c8249d8ca3b 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -3740,6 +3740,15 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b,
s64 *progs, u8 *image,
if (err)
return err;
+ /* If running under FineIBT, enter the preamble so the following
+ * indirect jump lands on a real ENDBR instead of the poison.
+ */
+ if (cfi_mode == CFI_FINEIBT) {
+ EMIT1_off32(0xb8, cfi_bpf_hash); /* mov
$cfi_bpf_hash, %eax */
+ EMIT1(add_1mod(0x48, BPF_REG_3)); /* sub rdx,
cfi_get_offset() */
+ EMIT2_off32(0x81, add_1reg(0xE8, BPF_REG_3),
cfi_get_offset());
+ }
+
emit_indirect_jump(&prog, BPF_REG_3 /* R3 -> rdx */, image +
(prog - buf));
*pprog = prog;
--
2.53.0
