[PATCH bpf-next] bpf: arm64: fix BPF_ST into arena memory

[PATCH bpf-next] bpf: arm64: fix BPF_ST into arena memory

[Puranjay Mohan]

The arm64 JIT supports BPF_ST with BPF_PROBE_MEM32 (arena) by using the
tmp2 register to hold the dst + arena_vm_base value and using tmp2 as the
new dst register. But this is broken because in case is_lsi_offset()
returns false the tmp2 will be clobbered by emit_a64_mov_i(1, tmp2, off,
ctx); and hence the emitted store instruction will be of the form:

	strb    w10, [x11, x11]

Fix this by using the third temporary register to hold the dst +
arena_vm_base.

Fixes: 339af577ec05 ("bpf: Add arm64 JIT support for PROBE_MEM32 pseudo instructions.")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
---
 arch/arm64/net/bpf_jit_comp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index ab83089c3d8f..348540b8e02d 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -785,6 +785,7 @@ static int emit_lse_atomic(const struct bpf_insn *insn, struct jit_ctx *ctx)
 	const u8 src = bpf2a64[insn->src_reg];
 	const u8 tmp = bpf2a64[TMP_REG_1];
 	const u8 tmp2 = bpf2a64[TMP_REG_2];
+	const u8 tmp3 = bpf2a64[TMP_REG_3];
 	const bool isdw = BPF_SIZE(code) == BPF_DW;
 	const bool arena = BPF_MODE(code) == BPF_PROBE_ATOMIC;
 	const s16 off = insn->off;
@@ -1757,8 +1758,8 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
 	case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
 	case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
 		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
-			emit(A64_ADD(1, tmp2, dst, arena_vm_base), ctx);
-			dst = tmp2;
+			emit(A64_ADD(1, tmp3, dst, arena_vm_base), ctx);
+			dst = tmp3;
 		}
 		if (dst == fp) {
 			dst_adj = ctx->priv_sp_used ? priv_sp : A64_SP;
-- 
2.47.3

Re: [PATCH bpf-next] bpf: arm64: fix BPF_ST into arena memory

[Puranjay Mohan]

Puranjay Mohan <puranjay@kernel.org> writes:

There is a build issue in this version, I have sent v2 with fix. please
review that one instead: https://lore.kernel.org/bpf/20251030121715.55214-1-puranjay@kernel.org/

Sorry for the noise.

Thanks,
Puranjay

> The arm64 JIT supports BPF_ST with BPF_PROBE_MEM32 (arena) by using the
> tmp2 register to hold the dst + arena_vm_base value and using tmp2 as the
> new dst register. But this is broken because in case is_lsi_offset()
> returns false the tmp2 will be clobbered by emit_a64_mov_i(1, tmp2, off,
> ctx); and hence the emitted store instruction will be of the form:
>
> 	strb    w10, [x11, x11]
>
> Fix this by using the third temporary register to hold the dst +
> arena_vm_base.
>
> Fixes: 339af577ec05 ("bpf: Add arm64 JIT support for PROBE_MEM32 pseudo instructions.")
> Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
> ---
>  arch/arm64/net/bpf_jit_comp.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index ab83089c3d8f..348540b8e02d 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -785,6 +785,7 @@ static int emit_lse_atomic(const struct bpf_insn *insn, struct jit_ctx *ctx)
>  	const u8 src = bpf2a64[insn->src_reg];
>  	const u8 tmp = bpf2a64[TMP_REG_1];
>  	const u8 tmp2 = bpf2a64[TMP_REG_2];
> +	const u8 tmp3 = bpf2a64[TMP_REG_3];
>  	const bool isdw = BPF_SIZE(code) == BPF_DW;
>  	const bool arena = BPF_MODE(code) == BPF_PROBE_ATOMIC;
>  	const s16 off = insn->off;
> @@ -1757,8 +1758,8 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
>  	case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
>  	case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
>  		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
> -			emit(A64_ADD(1, tmp2, dst, arena_vm_base), ctx);
> -			dst = tmp2;
> +			emit(A64_ADD(1, tmp3, dst, arena_vm_base), ctx);
> +			dst = tmp3;
>  		}
>  		if (dst == fp) {
>  			dst_adj = ctx->priv_sp_used ? priv_sp : A64_SP;
> -- 
> 2.47.3