Message ID | 962a80385cd29d1888480c5c6f062b5d4a992c30.1519678665.git.daniel@iogearbox.net |
---|---|
State | Accepted, archived |
Delegated to: | BPF Maintainers |
Headers | show |
Series | [bpf] bpf, ppc64: fix out of bounds access in tail call | expand |
On Mon, Feb 26, 2018 at 10:00:47PM +0100, Daniel Borkmann wrote: > While working on 16338a9b3ac3 ("bpf, arm64: fix out of bounds access in > tail call") I noticed that ppc64 JIT is partially affected as well. While > the bound checking is correctly performed as unsigned comparison, the > register with the index value however, is never truncated into 32 bit > space, so e.g. a index value of 0x100000000ULL with a map of 1 element > would pass with PPC_CMPLW() whereas we later on continue with the full > 64 bit register value. Therefore, as we do in interpreter and other JITs > truncate the value to 32 bit initially in order to fix access. > > Fixes: ce0761419fae ("powerpc/bpf: Implement support for tail calls") > Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> > Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> > Tested-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> Applied to bpf tree, thanks Daniel.
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c index 0a34b0c..0ef3d95 100644 --- a/arch/powerpc/net/bpf_jit_comp64.c +++ b/arch/powerpc/net/bpf_jit_comp64.c @@ -240,6 +240,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 * goto out; */ PPC_LWZ(b2p[TMP_REG_1], b2p_bpf_array, offsetof(struct bpf_array, map.max_entries)); + PPC_RLWINM(b2p_index, b2p_index, 0, 0, 31); PPC_CMPLW(b2p_index, b2p[TMP_REG_1]); PPC_BCC(COND_GE, out);