| From d9abd0eb941ae411b92c3e8a42d90402a09ff249 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 15 Dec 2021 18:38:30 -0800 |
| Subject: bpf: Fix extable fixup offset. |
| |
| From: Alexei Starovoitov <ast@kernel.org> |
| |
| [ Upstream commit 433956e91200734d09958673a56df02d00a917c2 ] |
| |
| The prog - start_of_ldx is the offset before the faulting ldx to the location |
| after it, so this will be used to adjust pt_regs->ip for jumping over it and |
| continuing, and with old temp it would have been fixed up to the wrong offset, |
| causing crash. |
| |
| Fixes: 4c5de127598e ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.") |
| Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
| Reviewed-by: Daniel Borkmann <daniel@iogearbox.net> |
| Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| arch/x86/net/bpf_jit_comp.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c |
| index 9ea57389c554b..462d8e68b3f43 100644 |
| --- a/arch/x86/net/bpf_jit_comp.c |
| +++ b/arch/x86/net/bpf_jit_comp.c |
| @@ -1332,7 +1332,7 @@ st: if (is_imm8(insn->off)) |
| * End result: x86 insn "mov rbx, qword ptr [rax+0x14]" |
| * of 4 bytes will be ignored and rbx will be zero inited. |
| */ |
| - ex->fixup = (prog - temp) | (reg2pt_regs[dst_reg] << 8); |
| + ex->fixup = (prog - start_of_ldx) | (reg2pt_regs[dst_reg] << 8); |
| } |
| break; |
| |
| -- |
| 2.33.0 |
| |
