| From foo@baz Mon Nov 15 03:31:49 PM CET 2021 |
| From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com> |
| Date: Mon, 15 Nov 2021 16:36:02 +0530 |
| Subject: powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 |
| To: <stable@vger.kernel.org> |
| Cc: Michael Ellerman <mpe@ellerman.id.au>, Daniel Borkmann <daniel@iogearbox.net> |
| Message-ID: <e229a9f62f5870d783eeb1a831ba60a2576a70a6.1636963359.git.naveen.n.rao@linux.vnet.ibm.com> |
| |
| From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com> |
| |
| upstream commit 5855c4c1f415ca3ba1046e77c0b3d3dfc96c9025 |
| |
| We aren't handling subtraction involving an immediate value of |
| 0x80000000 properly. Fix the same. |
| |
| Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF") |
| Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> |
| Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> |
| [mpe: Fold in fix from Naveen to use imm <= 32768] |
| Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> |
| Link: https://lore.kernel.org/r/fc4b1276eb10761fd7ce0814c8dd089da2815251.1633464148.git.naveen.n.rao@linux.vnet.ibm.com |
| [adjust macros to account for commits 0654186510a40e and 3a181237916310] |
| Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/powerpc/net/bpf_jit_comp64.c | 27 +++++++++++++++++---------- |
| 1 file changed, 17 insertions(+), 10 deletions(-) |
| |
| --- a/arch/powerpc/net/bpf_jit_comp64.c |
| +++ b/arch/powerpc/net/bpf_jit_comp64.c |
| @@ -349,18 +349,25 @@ static int bpf_jit_build_body(struct bpf |
| PPC_SUB(dst_reg, dst_reg, src_reg); |
| goto bpf_alu32_trunc; |
| case BPF_ALU | BPF_ADD | BPF_K: /* (u32) dst += (u32) imm */ |
| - case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ |
| case BPF_ALU64 | BPF_ADD | BPF_K: /* dst += imm */ |
| + if (!imm) { |
| + goto bpf_alu32_trunc; |
| + } else if (imm >= -32768 && imm < 32768) { |
| + PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); |
| + } else { |
| + PPC_LI32(b2p[TMP_REG_1], imm); |
| + PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); |
| + } |
| + goto bpf_alu32_trunc; |
| + case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ |
| case BPF_ALU64 | BPF_SUB | BPF_K: /* dst -= imm */ |
| - if (BPF_OP(code) == BPF_SUB) |
| - imm = -imm; |
| - if (imm) { |
| - if (imm >= -32768 && imm < 32768) |
| - PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); |
| - else { |
| - PPC_LI32(b2p[TMP_REG_1], imm); |
| - PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); |
| - } |
| + if (!imm) { |
| + goto bpf_alu32_trunc; |
| + } else if (imm > -32768 && imm <= 32768) { |
| + PPC_ADDI(dst_reg, dst_reg, IMM_L(-imm)); |
| + } else { |
| + PPC_LI32(b2p[TMP_REG_1], imm); |
| + PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]); |
| } |
| goto bpf_alu32_trunc; |
| case BPF_ALU | BPF_MUL | BPF_X: /* (u32) dst *= (u32) src */ |
