forked from mirrors/linux
		
	bpf, ppc64: do not reload skb pointers in non-skb context
The assumption of unconditionally reloading skb pointers on
BPF helper calls where bpf_helper_changes_pkt_data() holds
true is wrong. There can be different contexts where the helper
would enforce a reload such as in case of XDP. Here, we do
have a struct xdp_buff instead of struct sk_buff as context,
thus this will access garbage.
JITs only ever need to deal with cached skb pointer reload
when ld_abs/ind was seen, therefore guard the reload behind
SEEN_SKB.
Fixes: 156d0e290e ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
			
			
This commit is contained in:
		
							parent
							
								
									6d59b7dbf7
								
							
						
					
					
						commit
						87338c8e2c
					
				
					 1 changed files with 4 additions and 2 deletions
				
			
		| 
						 | 
					@ -763,7 +763,8 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 | 
				
			||||||
			func = (u8 *) __bpf_call_base + imm;
 | 
								func = (u8 *) __bpf_call_base + imm;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
			/* Save skb pointer if we need to re-cache skb data */
 | 
								/* Save skb pointer if we need to re-cache skb data */
 | 
				
			||||||
			if (bpf_helper_changes_pkt_data(func))
 | 
								if ((ctx->seen & SEEN_SKB) &&
 | 
				
			||||||
 | 
								    bpf_helper_changes_pkt_data(func))
 | 
				
			||||||
				PPC_BPF_STL(3, 1, bpf_jit_stack_local(ctx));
 | 
									PPC_BPF_STL(3, 1, bpf_jit_stack_local(ctx));
 | 
				
			||||||
 | 
					
 | 
				
			||||||
			bpf_jit_emit_func_call(image, ctx, (u64)func);
 | 
								bpf_jit_emit_func_call(image, ctx, (u64)func);
 | 
				
			||||||
| 
						 | 
					@ -772,7 +773,8 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 | 
				
			||||||
			PPC_MR(b2p[BPF_REG_0], 3);
 | 
								PPC_MR(b2p[BPF_REG_0], 3);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
			/* refresh skb cache */
 | 
								/* refresh skb cache */
 | 
				
			||||||
			if (bpf_helper_changes_pkt_data(func)) {
 | 
								if ((ctx->seen & SEEN_SKB) &&
 | 
				
			||||||
 | 
								    bpf_helper_changes_pkt_data(func)) {
 | 
				
			||||||
				/* reload skb pointer to r3 */
 | 
									/* reload skb pointer to r3 */
 | 
				
			||||||
				PPC_BPF_LL(3, 1, bpf_jit_stack_local(ctx));
 | 
									PPC_BPF_LL(3, 1, bpf_jit_stack_local(ctx));
 | 
				
			||||||
				bpf_jit_emit_skb_loads(image, ctx);
 | 
									bpf_jit_emit_skb_loads(image, ctx);
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in a new issue