Re: [PATCH bpf-next v3 08/24] arm64, insn: Reject invalid and unpredictable operands in the encoders

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] arm64, insn: s32 offset truncation in aarch64_insn_gen_adr() for
  ADRP
--

commit cecf5be8cc096127beade0ea92a07c5f62e297a6
Author: Daniel Borkmann <daniel@iogearbox.net>

arm64, insn: Reject invalid and unpredictable operands in the encoders

This commit rejects out-of-range and CONSTRAINED UNPREDICTABLE operands in
several arm64 instruction encoders so they return AARCH64_BREAK_FAULT.

> diff --git a/arch/arm64/lib/insn.c b/arch/arm64/lib/insn.c
> index 48a481aa9656c..87a06bd088115 100644
> --- a/arch/arm64/lib/insn.c
> +++ b/arch/arm64/lib/insn.c

[ ... ]

> @@ -1293,6 +1320,9 @@ u32 aarch64_insn_gen_adr(unsigned long pc, unsigned long addr,
>  	switch (type) {
>  	case AARCH64_INSN_ADR_TYPE_ADR:
>  		insn = aarch64_insn_get_adr_value();
> +		/* The s32 offset would truncate a difference beyond 4GB */
> +		if ((long)(addr - pc) != (s32)(addr - pc))
> +			return AARCH64_BREAK_FAULT;
>  		offset = addr - pc;
>  		break;
>  	case AARCH64_INSN_ADR_TYPE_ADRP:

[Severity: Low]
Can the AARCH64_INSN_ADR_TYPE_ADRP branch right below still truncate into
range when storing the shifted page difference into s32 offset?

arch/arm64/lib/insn.c:aarch64_insn_gen_adr() {
	u32 insn;
	s32 offset;
    ...
	case AARCH64_INSN_ADR_TYPE_ADRP:
		insn = aarch64_insn_get_adrp_value();
		offset = (addr - ALIGN_DOWN(pc, SZ_4K)) >> 12;
		break;
    ...
	if (offset < -SZ_1M || offset >= SZ_1M)
		return AARCH64_BREAK_FAULT;
}

When addr and pc are 16 TiB or more apart, bits [51:32] of the shifted page
offset are dropped before the [-SZ_1M, SZ_1M) range check.  Declaring offset
as long (like label_imm_common()) and casting the difference to long before
shifting in the ADRP case would avoid 32-bit truncation in both branches
without needing the separate s32 comparison.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794165614.git.daniel@iogearbox.net?part=8