lkml.org 
[lkml]   [2021]   [Dec]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 110/177] bpf: Fix extable fixup offset.
    Date
    From: Alexei Starovoitov <ast@kernel.org>

    [ Upstream commit 433956e91200734d09958673a56df02d00a917c2 ]

    The prog - start_of_ldx is the offset before the faulting ldx to the location
    after it, so this will be used to adjust pt_regs->ip for jumping over it and
    continuing, and with old temp it would have been fixed up to the wrong offset,
    causing crash.

    Fixes: 4c5de127598e ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.")
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Reviewed-by: Daniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/net/bpf_jit_comp.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
    index 9ea57389c554b..462d8e68b3f43 100644
    --- a/arch/x86/net/bpf_jit_comp.c
    +++ b/arch/x86/net/bpf_jit_comp.c
    @@ -1332,7 +1332,7 @@ st: if (is_imm8(insn->off))
    * End result: x86 insn "mov rbx, qword ptr [rax+0x14]"
    * of 4 bytes will be ignored and rbx will be zero inited.
    */
    - ex->fixup = (prog - temp) | (reg2pt_regs[dst_reg] << 8);
    + ex->fixup = (prog - start_of_ldx) | (reg2pt_regs[dst_reg] << 8);
    }
    break;

    --
    2.33.0


    \
     
     \ /
      Last update: 2021-12-20 16:02    [W:4.206 / U:0.348 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site