On 11/06/26 9:08 pm, [email protected] wrote:
From: Abhishek Dubey <[email protected]>
During pass 0 (size calculation), exit_addr is 0 since addrs[fp->len]
is not yet populated. bpf_jit_emit_exit_insn() treats a zero exit_addr
as in-range and skips bpf_jit_build_epilogue(), so the alternate inline
epilogue instructions are not counted in alloclen.
In later passes, if the real exit_addr falls outside the 32MB branch
range, the full inline epilogue is emitted into the already-allocated
buffer, writing past its end and corrupting adjacent memory.
Fix by ensuring exit_addr is non-zero before treating it as in-range,
so pass 0 always falls through to bpf_jit_build_epilogue() and
conservatively accounts for all epilogue instructions in alloclen.
Also conditionally range check alt_exit_addr directly.
Reported-by: [email protected]
Closes:
https://lore.kernel.org/bpf/[email protected]/T/#mfcb23909d977b949727cca4f59ee56a13fd69b92
Fixes: d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines")
Cc: [email protected]
Signed-off-by: Abhishek Dubey <[email protected]>
---
arch/powerpc/net/bpf_jit_comp.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index b36b55f12a8b..470a359b7807 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -128,11 +128,10 @@ void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage,
struct codegen_context
int bpf_jit_emit_exit_insn(u32 *image, u32 *fimage, struct codegen_context
*ctx,
int tmp_reg, long
exit_addr)
{
- if (!exit_addr || is_offset_in_branch_range(exit_addr - (ctx->idx *
4))) {
+ if (exit_addr && is_offset_in_branch_range(exit_addr - (long)(ctx->idx
* 4))) {
PPC_JMP(exit_addr);
- } else if (ctx->alt_exit_addr) {
- if (WARN_ON(!is_offset_in_branch_range((long)ctx->alt_exit_addr -
(ctx->idx * 4))))
- return -1;
+ } else if (ctx->alt_exit_addr &&
+ is_offset_in_branch_range(ctx->alt_exit_addr - (long)(ctx->idx
* 4))) {
"(long)ctx->alt_exit_addr - (ctx->idx * 4)" is not the same as
"ctx->alt_exit_addr - (long)(ctx->idx * 4)" with alt_exit_addr
defined as "unsigned int". I doubt if that was intentional?
Can you restore the earlier syntax for this statement..
PPC_JMP(ctx->alt_exit_addr);
} else {
ctx->alt_exit_addr = ctx->idx * 4;
- Hari
