Daniel Borkmann ddc665a4bb bpf, arm64: fix jit branch offset related to ldimm64 ... When the instruction right before the branch destination is a 64 bit load immediate, we currently calculate the wrong jump offset in the ctx->offset[] array as we only account one instruction slot for the 64 bit load immediate although it uses two BPF instructions. Fix it up by setting the offset into the right slot after we incremented the index. Before (ldimm64 test 1): [...] 00000020: 52800007 mov w7, #0x0 // #0 00000024: d2800060 mov x0, #0x3 // #3 00000028: d2800041 mov x1, #0x2 // #2 0000002c: eb01001f cmp x0, x1 00000030: 54ffff82 b.cs 0x00000020 00000034: d29fffe7 mov x7, #0xffff // #65535 00000038: f2bfffe7 movk x7, #0xffff, lsl #16 0000003c: f2dfffe7 movk x7, #0xffff, lsl #32 00000040: f2ffffe7 movk x7, #0xffff, lsl #48 00000044: d29dddc7 mov x7, #0xeeee // #61166 00000048: f2bdddc7 movk x7, #0xeeee, lsl #16 0000004c: f2ddddc7 movk x7, #0xeeee, lsl #32 00000050: f2fdddc7 movk x7, #0xeeee, lsl #48 [...] After (ldimm64 test 1): [...] 00000020: 52800007 mov w7, #0x0 // #0 00000024: d2800060 mov x0, #0x3 // #3 00000028: d2800041 mov x1, #0x2 // #2 0000002c: eb01001f cmp x0, x1 00000030: 540000a2 b.cs 0x00000044 00000034: d29fffe7 mov x7, #0xffff // #65535 00000038: f2bfffe7 movk x7, #0xffff, lsl #16 0000003c: f2dfffe7 movk x7, #0xffff, lsl #32 00000040: f2ffffe7 movk x7, #0xffff, lsl #48 00000044: d29dddc7 mov x7, #0xeeee // #61166 00000048: f2bdddc7 movk x7, #0xeeee, lsl #16 0000004c: f2ddddc7 movk x7, #0xeeee, lsl #32 00000050: f2fdddc7 movk x7, #0xeeee, lsl #48 [...] Also, add a couple of test cases to make sure JITs pass this test. Tested on Cavium ThunderX ARMv8. The added test cases all pass after the fix. Fixes: 8eee539dde ("arm64: bpf: fix out-of-bounds read in bpf2a64_offset()") Reported-by: David S. Miller <davem@davemloft.net> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Cc: Xi Wang <xi.wang@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-05-02 15:04:50 -04:00
..
842
fonts	lib/fonts/Kconfig: keep non-Sparc fonts listed together	2017-02-27 18:43:46 -08:00
lz4	lib/lz4: remove back-compat wrappers	2017-02-24 17:46:57 -08:00
lzo
mpi	mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]	2016-11-25 12:57:50 +11:00
raid6	lib/raid6: Add AVX2 optimized xor_syndrome functions	2016-11-07 15:08:20 -08:00
reed_solomon
xz
zlib_deflate
zlib_inflate
.gitignore
argv_split.c
asn1_decoder.c	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2016-05-17 09:33:39 -07:00
assoc_array.c
atomic64_test.c	lib: add module support to atomic64 tests	2017-02-24 17:46:57 -08:00
atomic64.c	locking/atomic: Implement atomic{,64,_long}_fetch_{add,sub,and,andnot,or,xor}{,_relaxed,_acquire,_release}()	2016-06-16 10:48:32 +02:00
audit.c
bcd.c
bch.c
bitmap.c	lib/bitmap.c: enhance bitmap syntax	2016-10-11 15:06:30 -07:00
bitrev.c
bsearch.c
btree.c
bug.c	sched/headers: Prepare to use <linux/rcuupdate.h> instead of <linux/rculist.h> in <linux/sched.h>	2017-03-02 08:42:38 +01:00
build_OID_registry
bust_spinlocks.c
chacha20.c	random: replace non-blocking pool with a Chacha20-based CRNG	2016-07-03 00:57:23 -04:00
check_signature.c
checksum.c
clz_ctz.c
clz_tab.c
cmdline.c
compat_audit.c
cordic.c
cpu_rmap.c
cpumask.c
crc7.c
crc8.c
crc16.c
crc32.c	lib: add module support to crc32 tests	2017-02-24 17:46:57 -08:00
crc32defs.h
crc32test.c	lib: add module support to crc32 tests	2017-02-24 17:46:57 -08:00
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
ctype.c
debug_info.c
debug_locks.c
debugobjects.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>	2017-03-02 08:42:36 +01:00
dec_and_lock.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c	lib/decompress_unlz4: change module to work with new LZ4 module version	2017-02-24 17:46:57 -08:00
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c
decompress.c
devres.c
digsig.c	KEYS: Differentiate uses of rcu_dereference_key() and user_key_payload()	2017-03-02 10:09:00 +11:00
div64.c
dma-debug.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>	2017-03-02 08:42:36 +01:00
dma-noop.c	lib/dma-noop: Clarify a comment	2017-01-24 12:23:35 -05:00
dma-virt.c	lib/dma-virt: Add dma_virt_ops	2017-01-24 12:23:35 -05:00
dump_stack.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
dynamic_debug.c	dynamic_debug: add jump label support	2016-08-04 08:50:07 -04:00
dynamic_queue_limits.c
earlycpio.c	lib/cpio: Make find_cpio_data()'s offset arg optional	2016-06-08 11:04:19 +02:00
extable.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
fault-inject.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
fdt.c
find_bit.c	lib/find_bit.c: micro-optimise find_next_*_bit	2017-02-24 17:46:57 -08:00
flex_array.c
flex_proportions.c
gcd.c	lib/GCD.c: use binary GCD algorithm instead of Euclidean	2016-05-20 17:58:30 -07:00
gen_crc32table.c
genalloc.c	lib/genalloc.c: start search from start of chunk	2016-10-27 18:43:43 -07:00
glob.c	lib: add module support to glob tests	2017-02-24 17:46:57 -08:00
globtest.c	lib: add module support to glob tests	2017-02-24 17:46:57 -08:00
hexdump.c
hweight.c	x86/hweight: Get rid of the special calling convention	2016-06-08 15:01:02 +02:00
idr.c	idr: Add missing __rcu annotations	2017-02-13 21:44:10 -05:00
inflate.c
int_sqrt.c
interval_tree_test.c
interval_tree.c
iomap_copy.c
iomap.c
iommu-common.c
iommu-helper.c	lib/iommu-helper: skip to next segment	2016-08-02 19:35:07 -04:00
ioremap.c	mm: convert generic code to 5-level paging	2017-03-09 11:48:47 -08:00
iov_iter.c	[iov_iter] new privimitive: iov_iter_revert()	2017-04-02 12:10:47 -04:00
irq_poll.c	This adds a new gcc plugin named "latent_entropy". It is designed to	2016-10-15 10:03:15 -07:00
irq_regs.c
is_single_threaded.c	sched/headers: Prepare to move 'init_task' and 'init_thread_union' from <linux/sched.h> to <linux/sched/task.h>	2017-03-02 08:42:38 +01:00
jedec_ddr_data.c
kasprintf.c
Kconfig	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-28 10:00:39 -08:00
Kconfig.debug	sparc64: Use LOCKDEP_SMALL, not PROVE_LOCKING_SMALL	2017-04-18 13:11:07 -07:00
Kconfig.kasan	mm, kasan: switch SLUB to stackdepot, enable memory quarantine for SLUB	2016-07-28 16:07:41 -07:00
Kconfig.kgdb	kgdb: depends on VT	2016-05-23 17:04:14 -07:00
Kconfig.kmemcheck
Kconfig.ubsan	Kconfig: lib/Kconfig.ubsan fix reference to ubsan documentation	2016-12-14 16:04:08 -08:00
kfifo.c
klist.c
kobject_uevent.c	kobject: improve function-level documentation	2016-10-28 02:42:10 -04:00
kobject.c
kstrtox.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
kstrtox.h
lcm.c
libcrc32c.c
list_debug.c	bug: switch data corruption check to __must_check	2017-02-24 17:46:56 -08:00
list_sort.c
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c	locking/selftest: Fix output since KERN_CONT changes	2016-11-25 07:12:19 +01:00
lockref.c	locking/core: Remove cpu_relax_lowlatency() users	2016-11-16 10:15:10 +01:00
lru_cache.c
Makefile	Merge branch 'idr-4.11' of git://git.infradead.org/users/willy/linux-dax	2017-02-28 20:29:41 -08:00
md5.c
memory-notifier-error-inject.c
memweight.c
net_utils.c
netdev-notifier-error-inject.c
nlattr.c	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
nmi_backtrace.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>	2017-03-02 08:42:34 +01:00
nodemask.c	include/linux/nodemask.h: create next_node_in() helper	2016-05-19 19:12:14 -07:00
notifier-error-inject.c
notifier-error-inject.h
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c
parman.c	lib: Introduce priority array area manager	2017-02-03 16:35:42 -05:00
parser.c	parser: add u64 number parser	2016-12-06 10:17:03 +02:00
pci_iomap.c
percpu_counter.c	percpu_counter: percpu_counter_hotcpu_callback() cleanup	2017-01-20 10:06:56 -05:00
percpu_ida.c	sched/headers: Prepare to remove the <linux/gfp.h> include from <linux/sched.h>	2017-03-02 08:42:34 +01:00
percpu_test.c
percpu-refcount.c	percpu-refcount: init ->confirm_switch member properly	2016-08-11 13:52:23 -04:00
plist.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h>	2017-03-02 08:42:27 +01:00
pm-notifier-error-inject.c
prime_numbers.c	lib/prime_numbers: Suppress warn on kmalloc failure	2017-01-23 09:17:12 +01:00
radix-tree.c	ida: Free correct IDA bitmap	2017-03-07 13:18:23 -05:00
random32.c	This adds a new gcc plugin named "latent_entropy". It is designed to	2016-10-15 10:03:15 -07:00
ratelimit.c	ratelimit: extend to print suppressed messages on release	2016-08-02 19:35:06 -04:00
rational.c
rbtree_test.c
rbtree.c	rbtree: use designated initializers	2017-02-24 17:46:57 -08:00
reciprocal_div.c
refcount.c	locking/refcounts: Change WARN() to WARN_ONCE()	2017-03-01 09:25:55 +01:00
rhashtable.c	rhashtable: compact struct rhashtable_params	2017-05-01 16:22:40 -04:00
sbitmap.c	kasan, sched/headers: Uninline kasan_enable/disable_current()	2017-03-02 08:42:25 +01:00
scatterlist.c	scatterlist: do not disable IRQs in sg_copy_buffer	2017-02-27 18:43:46 -08:00
seq_buf.c
sg_pool.c
sg_split.c
sha1.c
show_mem.c	lib/show_mem.c: teach show_mem to work with the given nodemask	2017-02-22 16:41:30 -08:00
siphash.c	siphash: implement HalfSipHash1-3 for hash tables	2017-01-09 13:58:57 -05:00
smp_processor_id.c	sched/core: Remove the tsk_cpus_allowed() wrapper	2017-03-02 08:42:24 +01:00
sort.c	lib: add CONFIG_TEST_SORT to enable self-test of sort()	2017-02-24 17:46:57 -08:00
stackdepot.c	lib/stackdepot: export save/fetch stack for drivers	2016-11-11 08:12:37 -08:00
stmp_device.c
string_helpers.c
string.c
strncpy_from_user.c	lib: harden strncpy_from_user	2016-10-11 15:06:30 -07:00
strnlen_user.c	unsafe_[get|put]_user: change interface to use a error target label	2016-08-08 13:02:01 -07:00
swiotlb.c	swiotlb: ensure that page-sized mappings are page-aligned	2017-01-15 12:37:24 -05:00
syscall.c	lib/syscall: Clear return values when no stack	2017-03-24 07:43:35 +01:00
test_bitmap.c
test_bpf.c	bpf, arm64: fix jit branch offset related to ldimm64	2017-05-02 15:04:50 -04:00
test_firmware.c	test_firmware: add test custom fallback trigger	2017-01-25 11:52:34 +01:00
test_hash.c	lib/test_hash.c: fix warning in preprocessor symbol evaluation	2016-09-01 17:52:01 -07:00
test_hexdump.c
test_kasan.c	kasan: report only the first error by default	2017-03-31 17:13:30 -07:00
test_module.c
test_parman.c	lib: fix spelling mistake: "actualy" -> "actually"	2017-02-26 11:03:38 -05:00
test_printf.c
test_rhashtable.c	rhashtable-test: Fix max_size parameter description	2016-08-08 12:52:42 -07:00
test_siphash.c	siphash: implement HalfSipHash1-3 for hash tables	2017-01-09 13:58:57 -05:00
test_sort.c	lib/test_sort.c: make it explicitly non-modular	2017-02-24 17:46:57 -08:00
test_static_key_base.c
test_static_keys.c
test_user_copy.c	usercopy: ARM NOMMU has no 64-bit get_user	2017-02-22 11:24:08 -08:00
test_uuid.c	lib/uuid: add a test module	2016-05-30 15:26:57 -07:00
test-kstrtox.c
test-string_helpers.c
textsearch.c
timerqueue.c	timerqueue: Use rb_entry_safe() instead of open-coding it	2017-01-20 08:03:42 +01:00
ts_bm.c
ts_fsm.c
ts_kmp.c
ubsan.c	UBSAN: fix typo in format string	2016-08-02 17:31:41 -04:00
ubsan.h
ucs2_string.c	lib/ucs2_string: Speed up ucs2_utf8size()	2016-09-09 16:08:46 +01:00
uuid.c	lib/uuid.c: use correct offset in uuid parser	2016-05-30 15:26:57 -07:00
vsprintf.c	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
win_minmax.c	lib/win_minmax: windowed min or max estimator	2016-09-21 00:22:59 -04:00