diff options
| author | Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> | 2021-10-05 22:25:21 +0200 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2021-10-07 09:52:33 +0200 |
| commit | 3832ba4e283d7052b783dab8311df7e3590fed93 (patch) | |
| tree | 7f887f980f7cebd58046d3213ac0fded3f38526b /arch/powerpc/net/bpf_jit_comp32.c | |
| parent | powerpc/lib: Add helper to check if offset is within conditional branch range (diff) | |
| download | linux-3832ba4e283d7052b783dab8311df7e3590fed93.tar.xz linux-3832ba4e283d7052b783dab8311df7e3590fed93.zip | |
powerpc/bpf: Validate branch ranges
Add checks to ensure that we never emit branch instructions with
truncated branch offsets.
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/71d33a6b7603ec1013c9734dd8bdd4ff5e929142.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
Diffstat (limited to 'arch/powerpc/net/bpf_jit_comp32.c')
| -rw-r--r-- | arch/powerpc/net/bpf_jit_comp32.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c index beb12cbc8c29..a74d52204f8d 100644 --- a/arch/powerpc/net/bpf_jit_comp32.c +++ b/arch/powerpc/net/bpf_jit_comp32.c @@ -200,7 +200,7 @@ void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 fun } } -static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) +static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) { /* * By now, the eBPF program has already setup parameters in r3-r6 @@ -261,7 +261,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 bpf_jit_emit_common_epilogue(image, ctx); EMIT(PPC_RAW_BCTR()); + /* out: */ + return 0; } /* Assemble the body code between the prologue & epilogue */ @@ -1090,7 +1092,9 @@ cond_branch: */ case BPF_JMP | BPF_TAIL_CALL: ctx->seen |= SEEN_TAILCALL; - bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); + ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); + if (ret < 0) + return ret; break; default: |