From: Ilya Leoshkevich <iii@linux.ibm.com>
To: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>
Cc: bpf@vger.kernel.org, Heiko Carstens <hca@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Ilya Leoshkevich <iii@linux.ibm.com>
Subject: [PATCH bpf-next v2 01/11] bpf: Fix atomic probe zero-extension
Date: Mon, 1 Jul 2024 15:24:39 +0200 [thread overview]
Message-ID: <20240701133432.3883-2-iii@linux.ibm.com> (raw)
In-Reply-To: <20240701133432.3883-1-iii@linux.ibm.com>
Zero-extending results of atomic probe operations fails with:
verifier bug. zext_dst is set, but no reg is defined
The problem is that insn_def_regno() handles BPF_ATOMICs, but not
BPF_PROBE_ATOMICs. Fix by adding the missing condition.
Fixes: d503a04f8bc0 ("bpf: Add support for certain atomics in bpf_arena to x86 JIT")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
kernel/bpf/verifier.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d3927d819465..e25ad5fb9115 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3217,7 +3217,8 @@ static int insn_def_regno(const struct bpf_insn *insn)
case BPF_ST:
return -1;
case BPF_STX:
- if (BPF_MODE(insn->code) == BPF_ATOMIC &&
+ if ((BPF_MODE(insn->code) == BPF_ATOMIC ||
+ BPF_MODE(insn->code) == BPF_PROBE_ATOMIC) &&
(insn->imm & BPF_FETCH)) {
if (insn->imm == BPF_CMPXCHG)
return BPF_REG_0;
--
2.45.2
next prev parent reply other threads:[~2024-07-01 13:35 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-01 13:24 [PATCH bpf-next v2 00/11] s390/bpf: Implement arena Ilya Leoshkevich
2024-07-01 13:24 ` Ilya Leoshkevich [this message]
2024-07-01 13:24 ` [PATCH bpf-next v2 02/11] s390/bpf: Factor out emitting probe nops Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 03/11] s390/bpf: Get rid of get_probe_mem_regno() Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 04/11] s390/bpf: Introduce pre- and post- probe functions Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 05/11] s390/bpf: Land on the next JITed instruction after exception Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 06/11] s390/bpf: Support BPF_PROBE_MEM32 Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 07/11] s390/bpf: Support address space cast instruction Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 08/11] s390/bpf: Enable arena Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 09/11] s390/bpf: Support arena atomics Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 10/11] selftests/bpf: Add UAF tests for " Ilya Leoshkevich
2024-07-01 15:22 ` Daniel Borkmann
2024-07-01 17:02 ` Ilya Leoshkevich
2024-07-01 13:24 ` [PATCH bpf-next v2 11/11] selftests/bpf: Remove arena tests from DENYLIST.s390x Ilya Leoshkevich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240701133432.3883-2-iii@linux.ibm.com \
--to=iii@linux.ibm.com \
--cc=agordeev@linux.ibm.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.