| From 6f3353c2d2b3eb4de52e9704cb962712033db181 Mon Sep 17 00:00:00 2001 |
| From: Vasily Gorbik <gor@linux.ibm.com> |
| Date: Tue, 20 Apr 2021 11:04:10 +0200 |
| Subject: s390/disassembler: increase ebpf disasm buffer size |
| |
| From: Vasily Gorbik <gor@linux.ibm.com> |
| |
| commit 6f3353c2d2b3eb4de52e9704cb962712033db181 upstream. |
| |
| Current ebpf disassembly buffer size of 64 is too small. E.g. this line |
| takes 65 bytes: |
| 01fffff8005822e: ec8100ed8065\tclgrj\t%r8,%r1,8,001fffff80058408\n\0 |
| |
| Double the buffer size like it is done for the kernel disassembly buffer. |
| |
| Fixes the following KASAN finding: |
| |
| UG: KASAN: stack-out-of-bounds in print_fn_code+0x34c/0x380 |
| Write of size 1 at addr 001fff800ad5f970 by task test_progs/853 |
| |
| CPU: 53 PID: 853 Comm: test_progs Not tainted |
| 5.12.0-rc7-23786-g23457d86b1f0-dirty #19 |
| Hardware name: IBM 3906 M04 704 (LPAR) |
| Call Trace: |
| [<0000000cd8e0538a>] show_stack+0x17a/0x1668 |
| [<0000000cd8e2a5d8>] dump_stack+0x140/0x1b8 |
| [<0000000cd8e16e74>] print_address_description.constprop.0+0x54/0x260 |
| [<0000000cd75a8698>] kasan_report+0xc8/0x130 |
| [<0000000cd6e26da4>] print_fn_code+0x34c/0x380 |
| [<0000000cd6ea0f4e>] bpf_int_jit_compile+0xe3e/0xe58 |
| [<0000000cd72c4c88>] bpf_prog_select_runtime+0x5b8/0x9c0 |
| [<0000000cd72d1bf8>] bpf_prog_load+0xa78/0x19c0 |
| [<0000000cd72d7ad6>] __do_sys_bpf.part.0+0x18e/0x768 |
| [<0000000cd6e0f392>] do_syscall+0x12a/0x220 |
| [<0000000cd8e333f8>] __do_syscall+0x98/0xc8 |
| [<0000000cd8e54834>] system_call+0x6c/0x94 |
| 1 lock held by test_progs/853: |
| #0: 0000000cd9bf7460 (report_lock){....}-{2:2}, at: |
| kasan_report+0x96/0x130 |
| |
| addr 001fff800ad5f970 is located in stack of task test_progs/853 at |
| offset 96 in frame: |
| print_fn_code+0x0/0x380 |
| this frame has 1 object: |
| [32, 96) 'buffer' |
| |
| Memory state around the buggy address: |
| 001fff800ad5f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 001fff800ad5f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| >001fff800ad5f900: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3 |
| ^ |
| 001fff800ad5f980: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| 001fff800ad5fa00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 |
| |
| Cc: <stable@vger.kernel.org> |
| Reviewed-by: Heiko Carstens <hca@linux.ibm.com> |
| Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> |
| Signed-off-by: Heiko Carstens <hca@linux.ibm.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/s390/kernel/dis.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/arch/s390/kernel/dis.c |
| +++ b/arch/s390/kernel/dis.c |
| @@ -2026,7 +2026,7 @@ void show_code(struct pt_regs *regs) |
| |
| void print_fn_code(unsigned char *code, unsigned long len) |
| { |
| - char buffer[64], *ptr; |
| + char buffer[128], *ptr; |
| int opsize, i; |
| |
| while (len) { |