• Pu Lehui's avatar
    riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops · 1732ebc4
    Pu Lehui authored
    We encountered a kernel crash triggered by the bpf_tcp_ca testcase as
    show below:
    
    Unable to handle kernel paging request at virtual address ff60000088554500
    Oops [#1]
    ...
    CPU: 3 PID: 458 Comm: test_progs Tainted: G           OE      6.8.0-rc1-kselftest_plain #1
    Hardware name: riscv-virtio,qemu (DT)
    epc : 0xff60000088554500
     ra : tcp_ack+0x288/0x1232
    epc : ff60000088554500 ra : ffffffff80cc7166 sp : ff2000000117ba50
     gp : ffffffff82587b60 tp : ff60000087be0040 t0 : ff60000088554500
     t1 : ffffffff801ed24e t2 : 0000000000000000 s0 : ff2000000117bbc0
     s1 : 0000000000000500 a0 : ff20000000691000 a1 : 0000000000000018
     a2 : 0000000000000001 a3 : ff60000087be03a0 a4 : 0000000000000000
     a5 : 0000000000000000 a6 : 0000000000000021 a7 : ffffffff8263f880
     s2 : 000000004ac3c13b s3 : 000000004ac3c13a s4 : 0000000000008200
     s5 : 0000000000000001 s6 : 0000000000000104 s7 : ff2000000117bb00
     s8 : ff600000885544c0 s9 : 0000000000000000 s10: ff60000086ff0b80
     s11: 000055557983a9c0 t3 : 0000000000000000 t4 : 000000000000ffc4
     t5 : ffffffff8154f170 t6 : 0000000000000030
    status: 0000000200000120 badaddr: ff60000088554500 cause: 000000000000000c
    Code: c796 67d7 0000 0000 0052 0002 c13b 4ac3 0000 0000 (0001) 0000
    ---[ end trace 0000000000000000 ]---
    
    The reason is that commit 2cd3e377 ("x86/cfi,bpf: Fix bpf_struct_ops
    CFI") changes the func_addr of arch_prepare_bpf_trampoline in struct_ops
    from NULL to non-NULL, while we use func_addr on RV64 to differentiate
    between struct_ops and regular trampoline. When the struct_ops testcase
    is triggered, it emits wrong prologue and epilogue, and lead to
    unpredictable issues. After commit 2cd3e377, we can use
    BPF_TRAMP_F_INDIRECT to distinguish them as it always be set in
    struct_ops.
    
    Fixes: 2cd3e377 ("x86/cfi,bpf: Fix bpf_struct_ops CFI")
    Signed-off-by: default avatarPu Lehui <pulehui@huawei.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Tested-by: default avatarBjörn Töpel <bjorn@rivosinc.com>
    Acked-by: default avatarBjörn Töpel <bjorn@kernel.org>
    Link: https://lore.kernel.org/bpf/20240123023207.1917284-1-pulehui@huaweicloud.com
    1732ebc4
bpf_jit_comp64.c 48.6 KB