* [PATCH 4.4 062/134] MIPS: BPF: Quit clobbering callee saved registers in JIT code.
[not found] <20180319171849.024066323@linuxfoundation.org>
@ 2018-03-19 18:05 ` Greg Kroah-Hartman
2018-03-19 18:05 ` [PATCH 4.4 063/134] MIPS: BPF: Fix multiple problems in JIT skb access helpers Greg Kroah-Hartman
1 sibling, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-19 18:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Daney, James Hogan,
Alexei Starovoitov, Steven J. Hill, linux-mips, netdev,
Ralf Baechle, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Daney <david.daney@cavium•com>
[ Upstream commit 1ef0910cfd681f0bd0b81f8809935b2006e9cfb9 ]
If bpf_needs_clear_a() returns true, only actually clear it if it is
ever used. If it is not used, we don't save and restore it, so the
clearing has the nasty side effect of clobbering caller state.
Also, don't emit stack pointer adjustment instructions if the
adjustment amount is zero.
Signed-off-by: David Daney <david.daney@cavium•com>
Cc: James Hogan <james.hogan@imgtec•com>
Cc: Alexei Starovoitov <ast@kernel•org>
Cc: Steven J. Hill <steven.hill@cavium•com>
Cc: linux-mips@linux-mips•org
Cc: netdev@vger•kernel.org
Cc: linux-kernel@vger•kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15745/
Signed-off-by: Ralf Baechle <ralf@linux-mips•org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft•com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation•org>
---
arch/mips/net/bpf_jit.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -527,7 +527,8 @@ static void save_bpf_jit_regs(struct jit
u32 sflags, tmp_flags;
/* Adjust the stack pointer */
- emit_stack_offset(-align_sp(offset), ctx);
+ if (offset)
+ emit_stack_offset(-align_sp(offset), ctx);
tmp_flags = sflags = ctx->flags >> SEEN_SREG_SFT;
/* sflags is essentially a bitmap */
@@ -579,7 +580,8 @@ static void restore_bpf_jit_regs(struct
emit_load_stack_reg(r_ra, r_sp, real_off, ctx);
/* Restore the sp and discard the scrach memory */
- emit_stack_offset(align_sp(offset), ctx);
+ if (offset)
+ emit_stack_offset(align_sp(offset), ctx);
}
static unsigned int get_stack_depth(struct jit_ctx *ctx)
@@ -626,8 +628,14 @@ static void build_prologue(struct jit_ct
if (ctx->flags & SEEN_X)
emit_jit_reg_move(r_X, r_zero, ctx);
- /* Do not leak kernel data to userspace */
- if (bpf_needs_clear_a(&ctx->skf->insns[0]))
+ /*
+ * Do not leak kernel data to userspace, we only need to clear
+ * r_A if it is ever used. In fact if it is never used, we
+ * will not save/restore it, so clearing it in this case would
+ * corrupt the state of the caller.
+ */
+ if (bpf_needs_clear_a(&ctx->skf->insns[0]) &&
+ (ctx->flags & SEEN_A))
emit_jit_reg_move(r_A, r_zero, ctx);
}
^ permalink raw reply [flat|nested] 2+ messages in thread* [PATCH 4.4 063/134] MIPS: BPF: Fix multiple problems in JIT skb access helpers.
[not found] <20180319171849.024066323@linuxfoundation.org>
2018-03-19 18:05 ` [PATCH 4.4 062/134] MIPS: BPF: Quit clobbering callee saved registers in JIT code Greg Kroah-Hartman
@ 2018-03-19 18:05 ` Greg Kroah-Hartman
1 sibling, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2018-03-19 18:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Daney, James Hogan,
Alexei Starovoitov, Steven J. Hill, linux-mips, netdev,
Ralf Baechle, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Daney <david.daney@cavium•com>
[ Upstream commit a81507c79f4ae9a0f9fb1054b59b62a090620dd9 ]
o Socket data is unsigned, so use unsigned accessors instructions.
o Fix path result pointer generation arithmetic.
o Fix half-word byte swapping code for unsigned semantics.
Signed-off-by: David Daney <david.daney@cavium•com>
Cc: James Hogan <james.hogan@imgtec•com>
Cc: Alexei Starovoitov <ast@kernel•org>
Cc: Steven J. Hill <steven.hill@cavium•com>
Cc: linux-mips@linux-mips•org
Cc: netdev@vger•kernel.org
Cc: linux-kernel@vger•kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15747/
Signed-off-by: Ralf Baechle <ralf@linux-mips•org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft•com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation•org>
---
arch/mips/net/bpf_jit_asm.S | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- a/arch/mips/net/bpf_jit_asm.S
+++ b/arch/mips/net/bpf_jit_asm.S
@@ -90,18 +90,14 @@ FEXPORT(sk_load_half_positive)
is_offset_in_header(2, half)
/* Offset within header boundaries */
PTR_ADDU t1, $r_skb_data, offset
- .set reorder
- lh $r_A, 0(t1)
- .set noreorder
+ lhu $r_A, 0(t1)
#ifdef CONFIG_CPU_LITTLE_ENDIAN
# if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
- wsbh t0, $r_A
- seh $r_A, t0
+ wsbh $r_A, $r_A
# else
- sll t0, $r_A, 24
- andi t1, $r_A, 0xff00
- sra t0, t0, 16
- srl t1, t1, 8
+ sll t0, $r_A, 8
+ srl t1, $r_A, 8
+ andi t0, t0, 0xff00
or $r_A, t0, t1
# endif
#endif
@@ -115,7 +111,7 @@ FEXPORT(sk_load_byte_positive)
is_offset_in_header(1, byte)
/* Offset within header boundaries */
PTR_ADDU t1, $r_skb_data, offset
- lb $r_A, 0(t1)
+ lbu $r_A, 0(t1)
jr $r_ra
move $r_ret, zero
END(sk_load_byte)
@@ -139,6 +135,11 @@ FEXPORT(sk_load_byte_positive)
* (void *to) is returned in r_s0
*
*/
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+#define DS_OFFSET(SIZE) (4 * SZREG)
+#else
+#define DS_OFFSET(SIZE) ((4 * SZREG) + (4 - SIZE))
+#endif
#define bpf_slow_path_common(SIZE) \
/* Quick check. Are we within reasonable boundaries? */ \
LONG_ADDIU $r_s1, $r_skb_len, -SIZE; \
@@ -150,7 +151,7 @@ FEXPORT(sk_load_byte_positive)
PTR_LA t0, skb_copy_bits; \
PTR_S $r_ra, (5 * SZREG)($r_sp); \
/* Assign low slot to a2 */ \
- move a2, $r_sp; \
+ PTR_ADDIU a2, $r_sp, DS_OFFSET(SIZE); \
jalr t0; \
/* Reset our destination slot (DS but it's ok) */ \
INT_S zero, (4 * SZREG)($r_sp); \
^ permalink raw reply [flat|nested] 2+ messages in thread