Re: [PATCH bpf-next v3 5/6] bpf, s390: Clear fetch destination on faulting arena atomic

[Ilya Leoshkevich <iii@linux.ibm.com>]

On 8/11/26 15:15, Daniel Borkmann wrote:
> Same missing register clear as on riscv64. A RMW atomic on an arena pointer
> is converted to BPF_PROBE_ATOMIC and gets an exception table entry, but
> bpf_jit_probe_atomic_pre() only fills in the arena base and the probe
> offset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which
> bpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads
> back as "there is nothing to clear".
> 
> That is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory,
> but an RMW carrying BPF_FETCH also reads the old value into a register:
> src_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for
> BPF_CMPXCHG. So on a fault over an unmapped arena page the program resumes
> at the landing pad with whatever that register held before the atomic
> instead of the 0 that every other BPF_PROBE_* access delivers.
> 
> Fill probe->reg in from bpf_atomic_load_reg(). Unlike x86-64 and arm64,
> s390x does not report arena violations from its exception handler, so there
> is no access direction to correct here, only the missing register clear.
> 
> Fixes: 2f9469484a3b ("s390/bpf: Support arena atomics")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Cc: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
>   arch/s390/net/bpf_jit_comp.c | 11 +++++++++++
>   1 file changed, 11 insertions(+)

Looks reasonable, thanks!

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>