Re: [PATCH bpf-next 1/2] bpf, parisc: Add support for BPF_SDIV and BPF_SMOD in the parisc64 JIT

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch implements BPF_SDIV and BPF_SMOD for the 64-bit PA-RISC JIT but omits the 32-bit JIT, causing signed divisions to be silently miscompiled as unsigned.
--

--- Patch [1]: [PATCH bpf-next 1/2] bpf, parisc: Add support for BPF_SDIV and BPF_SMOD in the parisc64 JIT ---
commit 5e5d75e62e2afee7aac7d5510ab28785201de9f5
Author: Nicholas Dudar <main.kalliope@gmail.com>

bpf, parisc: Add support for BPF_SDIV and BPF_SMOD in the parisc64 JIT

This commit adds support for signed division and modulo (BPF_SDIV and
BPF_SMOD) to the 64-bit PA-RISC BPF JIT. It passes the signedness check
down to the emission functions and introduces signed libgcc helper
wrappers.

> bpf, parisc: Add support for BPF_SDIV and BPF_SMOD in the parisc64 JIT

[Severity: High]
This is a pre-existing issue, but does the 32-bit PA-RISC JIT still
miscompile signed divisions as unsigned?

While this patch correctly implements BPF_SDIV and BPF_SMOD for the 64-bit
JIT, arch/parisc/net/bpf_jit_comp32.c appears to still unconditionally
accept these instructions without checking if insn->off == 1.

In arch/parisc/net/bpf_jit_comp32.c:bpf_jit_emit_insn():

    case BPF_ALU | BPF_DIV | BPF_X:
    case BPF_ALU | BPF_DIV | BPF_K:
    case BPF_ALU | BPF_MOD | BPF_X:
    case BPF_ALU | BPF_MOD | BPF_K:
        /* ... */
        emit_alu_r32(dst, src, ctx, BPF_OP(code));

And then in emit_alu_r32():

    case BPF_DIV:
        emit_call_millicode($$divU, lo(rd), lo(rs), op, ctx);
        break;
    case BPF_MOD:
        emit_call_millicode($$remU, lo(rd), lo(rs), op, ctx);
        break;

Because the JIT silently compiles signed division as unsigned ($$divU),
and the eBPF verifier calculates memory bounds assuming a signed result,
could this verifier-JIT desynchronization be exploited to bypass bounds
checks?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717190544.257306-1-main.kalliope@gmail.com?part=1