From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D50E0268FED; Tue, 8 Apr 2025 11:34:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744112074; cv=none; b=K+McVRnX86t40Vd2/swXADUICsarP7O5ekdwQAfIJGYSRQnCv+s1FNuWyrxwRpsD+T8heAHpAveXro2y8+JVPNWly/H2/yBLL8WYf18Q4eE+NKEsTZ8Hv0vj7EmvApYJzwqmrWxWofropcqLDQx3SXsijPMPRNPBbQ7eOSzJqOo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744112074; c=relaxed/simple; bh=LiD+vXlR8E0QrcvHxeAoW7MT6r78I43GPUEuO5VKlqo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jjMMhLot79EhsyK9DMz28tLo0R86CqOrZHxVAJCv1Fv9vMEZ+O6CCUZTgLCdxjQvk9PmXGNjBTGtfEEgH8v+BbkKL8+g7j/RD3/pGMOQ64tfTFaj5ZCJXNiKN4Tl6UX6XE/GGuCc7T3BqRV8Mn9WZ7ZB/owS3MwtJ0iKMG9FCRY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=diZt3MMZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="diZt3MMZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63027C4CEEB; Tue, 8 Apr 2025 11:34:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1744112074; bh=LiD+vXlR8E0QrcvHxeAoW7MT6r78I43GPUEuO5VKlqo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=diZt3MMZRTttP2SZ/DBtlF85VsjNntY71Lbxhr9TDZFo6ExNKG6tuwEFFYipMUDwW 6yseCahebdJnBThfQ0+dy96OnZCdelI1tZ5DmJlj/h7wj4vQJjys9SpjKMunU2hfWL WpbNSonl9PpKG3EsFzEYNLtEE5d3OU/2l5Gv9vV0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Vincent Li , Hengqi Chen , Huacai Chen Subject: [PATCH 6.14 665/731] LoongArch: BPF: Fix off-by-one error in build_prologue() Date: Tue, 8 Apr 2025 12:49:22 +0200 Message-ID: <20250408104929.735001813@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250408104914.247897328@linuxfoundation.org> References: <20250408104914.247897328@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hengqi Chen commit 7e2586991e36663c9bc48c828b83eab180ad30a9 upstream. Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue. There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the first pass and then generates N+1 insns in the second pass. This makes epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by inserting a nop insn. Cc: stable@vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Fixes: bb035ef0cc91 ("LoongArch: BPF: Support mixing bpf2bpf and tailcalls") Reported-by: Vincent Li Tested-by: Vincent Li Closes: https://lore.kernel.org/loongarch/CAK3+h2w6WESdBN3UCr3WKHByD7D6Q_Ve1EDAjotVrnx6Or_c8g@mail.gmail.com/ Closes: https://lore.kernel.org/bpf/CAK3+h2woEjG_N=-XzqEGaAeCmgu2eTCUc7p6bP4u8Q+DFHm-7g@mail.gmail.com/ Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen Signed-off-by: Greg Kroah-Hartman --- arch/loongarch/net/bpf_jit.c | 2 ++ arch/loongarch/net/bpf_jit.h | 5 +++++ 2 files changed, 7 insertions(+) --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -142,6 +142,8 @@ static void build_prologue(struct jit_ct */ if (seen_tail_call(ctx) && seen_call(ctx)) move_reg(ctx, TCC_SAVED, REG_TCC); + else + emit_insn(ctx, nop); ctx->stack_size = stack_adjust; } --- a/arch/loongarch/net/bpf_jit.h +++ b/arch/loongarch/net/bpf_jit.h @@ -27,6 +27,11 @@ struct jit_data { struct jit_ctx ctx; }; +static inline void emit_nop(union loongarch_instruction *insn) +{ + insn->word = INSN_NOP; +} + #define emit_insn(ctx, func, ...) \ do { \ if (ctx->image != NULL) { \