From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227SEm9BDah4kOWgAU8mW4cfcKBLVUAgAAD3Yda0HemvQQa/O/e1kDBGkcy0E55x1lPV09br ARC-Seal: i=1; a=rsa-sha256; t=1517256845; cv=none; d=google.com; s=arc-20160816; b=gT+eicC7FbrwCCXQI2+KIVc+AmatrPHP8YaVA9sb4jdleXLnSXnF9Ys91gc/Dr6xsD q7GWwS+0y6AfcXZ2Z3TtZJ+Yu9HUCjFtj4BvibST9upMDbuyx4v840KWbGYoqkhe9UYb L0zh9KuqnYkBapTqoM2DxrGGmQqJRk/W3TY+qBcwWmf2IGYhQjJ6JcI+7pw3JPPPhJtQ wdSYWFIS61XavU9j5N+jVh5k4oAl8oz7087QJ9tzxtY3SbpFjA+bMP/wevzPXZk7IWHZ RRbykufgKhAwMbaPlYEtG9ks5rpAzwwl2PZDljBtE8JBURrZdoa6UrQbB6mflOMSqZqQ HuOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=wgCIGG+B8Otw4wnOuIzE4Z8c7mgrBaxVAsgh0OaacP0=; b=RzzEvrCjeEvA3iXmfDGMD7POeFsfU+srCg2irgYS6MlEepIQaDA5hKBKV/XBpxSO3L bkx5qJCglGUSpu2b4iNxsmLxMp+eIyrLdM78SgddpvKXpegyQUaJqTpg9r6krMqFlklx TZrc/iLa/5YczeYb7K84zFb8kxKjkChrpnAsTA/AkcJ78W/gmqTOfu75J/IV91STiwte Fq0T65G+qEd1A+rx239sD8+Bfg1Q0cP2RxaP22PdICcIBlMvw1203bReGNLpu9li415c UY8UDsiZCJ3ecThbIkLmvu+WnI2mgRswWAzM0L+kK7HGTQboz3GK4mMnJuprAp4OPM8o Ao2w== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "ast@kernel.org, stable@vger.kernel.org, Daniel Borkmann" , syzbot+48340bb518e88849e2e3@syzkaller.appspotmail.com, Alexei Starovoitov , Daniel Borkmann Subject: [PATCH 4.14 68/71] bpf: fix 32-bit divide by zero Date: Mon, 29 Jan 2018 13:57:36 +0100 Message-Id: <20180129123832.129423809@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123827.271171825@linuxfoundation.org> References: <20180129123827.271171825@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958976394718299?= X-GMAIL-MSGID: =?utf-8?q?1590959113948376689?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alexei Starovoitov [ upstream commit 68fda450a7df51cff9e5a4d4a4d9d0d5f2589153 ] due to some JITs doing if (src_reg == 0) check in 64-bit mode for div/mod operations mask upper 32-bits of src register before doing the check Fixes: 622582786c9e ("net: filter: x86: internal BPF JIT") Fixes: 7a12b5031c6b ("sparc64: Add eBPF JIT.") Reported-by: syzbot+48340bb518e88849e2e3@syzkaller.appspotmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/verifier.c | 18 ++++++++++++++++++ net/core/filter.c | 4 ++++ 2 files changed, 22 insertions(+) --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4304,6 +4304,24 @@ static int fixup_bpf_calls(struct bpf_ve int i, cnt, delta = 0; for (i = 0; i < insn_cnt; i++, insn++) { + if (insn->code == (BPF_ALU | BPF_MOD | BPF_X) || + insn->code == (BPF_ALU | BPF_DIV | BPF_X)) { + /* due to JIT bugs clear upper 32-bits of src register + * before div/mod operation + */ + insn_buf[0] = BPF_MOV32_REG(insn->src_reg, insn->src_reg); + insn_buf[1] = *insn; + cnt = 2; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + if (insn->code != (BPF_JMP | BPF_CALL)) continue; --- a/net/core/filter.c +++ b/net/core/filter.c @@ -457,6 +457,10 @@ do_pass: convert_bpf_extensions(fp, &insn)) break; + if (fp->code == (BPF_ALU | BPF_DIV | BPF_X) || + fp->code == (BPF_ALU | BPF_MOD | BPF_X)) + *insn++ = BPF_MOV32_REG(BPF_REG_X, BPF_REG_X); + *insn = BPF_RAW_INSN(fp->code, BPF_REG_A, BPF_REG_X, 0, fp->k); break;