From: Ilya Leoshkevich <iii@linux.ibm.com>
To: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>
Cc: bpf@vger.kernel.org, Heiko Carstens <hca@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Ilya Leoshkevich <iii@linux.ibm.com>,
Puranjay Mohan <puranjay12@gmail.com>
Subject: [PATCH bpf-next v2 01/10] bpf: Disable zero-extension for BPF_MEMSX
Date: Tue, 19 Sep 2023 12:09:03 +0200 [thread overview]
Message-ID: <20230919101336.2223655-2-iii@linux.ibm.com> (raw)
In-Reply-To: <20230919101336.2223655-1-iii@linux.ibm.com>
On the architectures that use bpf_jit_needs_zext(), e.g., s390x, the
verifier incorrectly inserts a zero-extension after BPF_MEMSX, leading
to miscompilations like the one below:
24: 89 1a ff fe 00 00 00 00 "r1 = *(s16 *)(r10 - 2);" # zext_dst set
0x3ff7fdb910e: lgh %r2,-2(%r13,%r0) # load halfword
0x3ff7fdb9114: llgfr %r2,%r2 # wrong!
25: 65 10 00 03 00 00 7f ff if r1 s> 32767 goto +3 <l0_1> # check_cond_jmp_op()
Disable such zero-extensions. The JITs need to insert sign-extension
themselves, if necessary.
Suggested-by: Puranjay Mohan <puranjay12@gmail.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a7178ecf676d..614bf3fa4fd5 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3114,7 +3114,7 @@ static bool is_reg64(struct bpf_verifier_env *env, struct bpf_insn *insn,
if (class == BPF_LDX) {
if (t != SRC_OP)
- return BPF_SIZE(code) == BPF_DW;
+ return BPF_SIZE(code) == BPF_DW || BPF_MODE(code) == BPF_MEMSX;
/* LDX source must be ptr. */
return true;
}
--
2.41.0
next prev parent reply other threads:[~2023-09-19 10:14 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-19 10:09 [PATCH bpf-next v2 00/10] Implement cpuv4 support for s390x Ilya Leoshkevich
2023-09-19 10:09 ` Ilya Leoshkevich [this message]
2023-09-21 12:35 ` [PATCH bpf-next v2 01/10] bpf: Disable zero-extension for BPF_MEMSX Puranjay Mohan
2023-09-19 10:09 ` [PATCH bpf-next v2 02/10] selftests/bpf: Unmount the cgroup2 work directory Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 03/10] selftests/bpf: Add big-endian support to the ldsx test Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 04/10] s390/bpf: Implement BPF_MOV | BPF_X with sign-extension Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 05/10] s390/bpf: Implement BPF_MEMSX Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 06/10] s390/bpf: Implement unconditional byte swap Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 07/10] s390/bpf: Implement unconditional jump with 32-bit offset Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 08/10] s390/bpf: Implement signed division Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 09/10] selftests/bpf: Enable the cpuv4 tests for s390x Ilya Leoshkevich
2023-09-19 10:09 ` [PATCH bpf-next v2 10/10] selftests/bpf: Trim DENYLIST.s390x Ilya Leoshkevich
2023-09-21 21:30 ` [PATCH bpf-next v2 00/10] Implement cpuv4 support for s390x patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230919101336.2223655-2-iii@linux.ibm.com \
--to=iii@linux.ibm.com \
--cc=agordeev@linux.ibm.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=puranjay12@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.