This is a note to let you know that I've just added the patch titled
[PATCH stable/4.14 05/14] bpf, sparc: fix usage of wrong reg for load_skb_regs after call
to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...
The filename of the patch is: bpf-sparc-fix-usage-of-wrong-reg-for-load_skb_regs-after-call.patch and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.
From foo@baz Fri Dec 22 16:47:02 CET 2017
From: Daniel Borkmann daniel@iogearbox.net Date: Fri, 22 Dec 2017 16:23:03 +0100 Subject: [PATCH stable/4.14 05/14] bpf, sparc: fix usage of wrong reg for load_skb_regs after call To: gregkh@linuxfoundation.org Cc: ast@kernel.org, daniel@iogearbox.net, jannh@google.com, stable@vger.kernel.org Message-ID: 20171222152312.2945-6-daniel@iogearbox.net
From: Daniel Borkmann daniel@iogearbox.net
[ Upstream commit 07aee94394547721ac168cbf4e1c09c14a5fe671 ]
When LD_ABS/IND is used in the program, and we have a BPF helper call that changes packet data (bpf_helper_changes_pkt_data() returns true), then in case of sparc JIT, we try to reload cached skb data from bpf2sparc[BPF_REG_6]. However, there is no such guarantee or assumption that skb sits in R6 at this point, all helpers changing skb data only have a guarantee that skb sits in R1. Therefore, store BPF R1 in L7 temporarily and after procedure call use L7 to reload cached skb data. skb sitting in R6 is only true at the time when LD_ABS/IND is executed.
Fixes: 7a12b5031c6b ("sparc64: Add eBPF JIT.") Signed-off-by: Daniel Borkmann daniel@iogearbox.net Acked-by: David S. Miller davem@davemloft.net Acked-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/sparc/net/bpf_jit_comp_64.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/sparc/net/bpf_jit_comp_64.c +++ b/arch/sparc/net/bpf_jit_comp_64.c @@ -1245,14 +1245,16 @@ static int build_insn(const struct bpf_i u8 *func = ((u8 *)__bpf_call_base) + imm;
ctx->saw_call = true; + if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func)) + emit_reg_move(bpf2sparc[BPF_REG_1], L7, ctx);
emit_call((u32 *)func, ctx); emit_nop(ctx);
emit_reg_move(O0, bpf2sparc[BPF_REG_0], ctx);
- if (bpf_helper_changes_pkt_data(func) && ctx->saw_ld_abs_ind) - load_skb_regs(ctx, bpf2sparc[BPF_REG_6]); + if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func)) + load_skb_regs(ctx, L7); break; }
Patches currently in stable-queue which might be from daniel@iogearbox.net are
queue-4.14/bpf-fix-integer-overflows.patch queue-4.14/bpf-fix-branch-pruning-logic.patch queue-4.14/bpf-s390x-do-not-reload-skb-pointers-in-non-skb-context.patch queue-4.14/bpf-sparc-fix-usage-of-wrong-reg-for-load_skb_regs-after-call.patch queue-4.14/bpf-fix-incorrect-tracking-of-register-size-truncation.patch queue-4.14/bpf-don-t-prune-branches-when-a-scalar-is-replaced-with-a-pointer.patch queue-4.14/bpf-verifier-fix-bounds-calculation-on-bpf_rsh.patch queue-4.14/selftests-bpf-add-tests-for-recent-bugfixes.patch queue-4.14/bpf-fix-corruption-on-concurrent-perf_event_output-calls.patch queue-4.14/bpf-fix-incorrect-sign-extension-in-check_alu_op.patch queue-4.14/bpf-ppc64-do-not-reload-skb-pointers-in-non-skb-context.patch queue-4.14/bpf-fix-missing-error-return-in-check_stack_boundary.patch queue-4.14/bpf-force-strict-alignment-checks-for-stack-pointers.patch queue-4.14/bpf-fix-32-bit-alu-op-verification.patch queue-4.14/bpf-fix-build-issues-on-um-due-to-mising-bpf_perf_event.h.patch