• Puranjay Mohan's avatar
    bpf, arm64: fix bug in BPF_LDX_MEMSX · 114b5b3b
    Puranjay Mohan authored
    A64_LDRSW() takes three registers: Xt, Xn, Xm as arguments and it loads
    and sign extends the value at address Xn + Xm into register Xt.
    
    Currently, the offset is being directly used in place of the tmp
    register which has the offset already loaded by the last emitted
    instruction.
    
    This will cause JIT failures. The easiest way to reproduce this is to
    test the following code through test_bpf module:
    
    {
    	"BPF_LDX_MEMSX | BPF_W",
    	.u.insns_int = {
    		BPF_LD_IMM64(R1, 0x00000000deadbeefULL),
    		BPF_LD_IMM64(R2, 0xffffffffdeadbeefULL),
    		BPF_STX_MEM(BPF_DW, R10, R1, -7),
    		BPF_LDX_MEMSX(BPF_W, R0, R10, -7),
    		BPF_JMP_REG(BPF_JNE, R0, R2, 1),
    		BPF_ALU64_IMM(BPF_MOV, R0, 0),
    		BPF_EXIT_INSN(),
    	},
    	INTERNAL,
    	{ },
    	{ { 0, 0 } },
    	.stack_depth = 7,
    },
    
    We need to use the offset as -7 to trigger this code path, there could
    be other valid ways to trigger this from proper BPF programs as well.
    
    This code is rejected by the JIT because -7 is passed to A64_LDRSW() but
    it expects a valid register (0 - 31).
    
     roott@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W"
     [11300.490371] test_bpf: test_bpf: set 'test_bpf' as the default test_suite.
     [11300.491750] test_bpf: #345 BPF_LDX_MEMSX | BPF_W
     [11300.493179] aarch64_insn_encode_register: unknown register encoding -7
     [11300.494133] aarch64_insn_encode_register: unknown register encoding -7
     [11300.495292] FAIL to select_runtime err=-524
     [11300.496804] test_bpf: Summary: 0 PASSED, 1 FAILED, [0/0 JIT'ed]
     modprobe: ERROR: could not insert 'test_bpf': Invalid argument
    
    Applying this patch fixes the issue.
    
     root@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W"
     [  292.837436] test_bpf: test_bpf: set 'test_bpf' as the default test_suite.
     [  292.839416] test_bpf: #345 BPF_LDX_MEMSX | BPF_W jited:1 156 PASS
     [  292.844794] test_bpf: Summary: 1 PASSED, 0 FAILED, [1/1 JIT'ed]
    
    Fixes: cc88f540 ("bpf, arm64: Support sign-extension load instructions")
    Signed-off-by: default avatarPuranjay Mohan <puranjay12@gmail.com>
    Message-ID: <20240312235917.103626-1-puranjay12@gmail.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    114b5b3b
bpf_jit_comp.c 65.5 KB