]> git.baikalelectronics.ru Git - kernel.git/commit
bpf, ppc64: fix out of bounds access in tail call
authorDaniel Borkmann <daniel@iogearbox.net>
Mon, 26 Feb 2018 21:00:47 +0000 (22:00 +0100)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 27 Feb 2018 03:58:09 +0000 (19:58 -0800)
commiteb90af72386502660949626a904a0a5bc25e8941
treeeab10ae38510366a09272649438b9257218cbb03
parentc15bd5900ee84cd89c43db0d252caaa07eabd30e
bpf, ppc64: fix out of bounds access in tail call

While working on 8c5a89650b42 ("bpf, arm64: fix out of bounds access in
tail call") I noticed that ppc64 JIT is partially affected as well. While
the bound checking is correctly performed as unsigned comparison, the
register with the index value however, is never truncated into 32 bit
space, so e.g. a index value of 0x100000000ULL with a map of 1 element
would pass with PPC_CMPLW() whereas we later on continue with the full
64 bit register value. Therefore, as we do in interpreter and other JITs
truncate the value to 32 bit initially in order to fix access.

Fixes: 43db670a33cd ("powerpc/bpf: Implement support for tail calls")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Tested-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
arch/powerpc/net/bpf_jit_comp64.c