Commit 3832ba4e authored by Naveen N. Rao's avatar Naveen N. Rao Committed by Michael Ellerman
Browse files

powerpc/bpf: Validate branch ranges 



Add checks to ensure that we never emit branch instructions with
truncated branch offsets.

Suggested-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Signed-off-by: default avatarNaveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Tested-by: default avatarJohan Almbladh <johan.almbladh@anyfinetworks.com>
Reviewed-by: default avatarChristophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: default avatarSong Liu <songliubraving@fb.com>
Acked-by: default avatarJohan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/71d33a6b7603ec1013c9734dd8bdd4ff5e929142.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
parent 4549c3ea

arch/powerpc/net/bpf_jit.h

+20 −6
Original line number Diff line number Diff line
@@ -24,16 +24,30 @@ 
#define EMIT(instr)		PLANT_INSTR(image, ctx->idx, instr)



/* Long jump; (unconditional 'branch') */

#define PPC_JMP(dest)		EMIT(PPC_INST_BRANCH |			      \

				     (((dest) - (ctx->idx * 4)) & 0x03fffffc))

#define PPC_JMP(dest)							      \

	do {								      \

		long offset = (long)(dest) - (ctx->idx * 4);		      \

		if (!is_offset_in_branch_range(offset)) {		      \

			pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx);			\

			return -ERANGE;					      \

		}							      \

		EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc));		      \

	} while (0)



/* blr; (unconditional 'branch' with link) to absolute address */

#define PPC_BL_ABS(dest)	EMIT(PPC_INST_BL |			      \

				     (((dest) - (unsigned long)(image + ctx->idx)) & 0x03fffffc))

/* "cond" here covers BO:BI fields. */

#define PPC_BCC_SHORT(cond, dest)	EMIT(PPC_INST_BRANCH_COND |	      \

					     (((cond) & 0x3ff) << 16) |	      \

					     (((dest) - (ctx->idx * 4)) &     \

					      0xfffc))

#define PPC_BCC_SHORT(cond, dest)					      \

	do {								      \

		long offset = (long)(dest) - (ctx->idx * 4);		      \

		if (!is_offset_in_cond_branch_range(offset)) {		      \

			pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx);		\

			return -ERANGE;					      \

		}							      \

		EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc));					\

	} while (0)



/* Sign-extended 32-bit immediate load */

#define PPC_LI32(d, i)		do {					      \

		if ((int)(uintptr_t)(i) >= -32768 &&			      \

arch/powerpc/net/bpf_jit_comp.c

+5 −1
Original line number Diff line number Diff line
@@ -210,7 +210,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) 
		/* Now build the prologue, body code & epilogue for real. */

		cgctx.idx = 0;

		bpf_jit_build_prologue(code_base, &cgctx);

		bpf_jit_build_body(fp, code_base, &cgctx, addrs, extra_pass);

		if (bpf_jit_build_body(fp, code_base, &cgctx, addrs, extra_pass)) {

			bpf_jit_binary_free(bpf_hdr);

			fp = org_fp;

			goto out_addrs;

		}

		bpf_jit_build_epilogue(code_base, &cgctx);



		if (bpf_jit_enable > 1)

arch/powerpc/net/bpf_jit_comp32.c

+6 −2
Original line number Diff line number Diff line
@@ -200,7 +200,7 @@ void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 fun 
	}

}



static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)

static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)

{

	/*

	 * By now, the eBPF program has already setup parameters in r3-r6
@@ -261,7 +261,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 
	bpf_jit_emit_common_epilogue(image, ctx);



	EMIT(PPC_RAW_BCTR());



	/* out: */

	return 0;

}



/* Assemble the body code between the prologue & epilogue */
@@ -1090,7 +1092,9 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context * 
		 */

		case BPF_JMP | BPF_TAIL_CALL:

			ctx->seen |= SEEN_TAILCALL;

			bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);

			ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);

			if (ret < 0)

				return ret;

			break;



		default:

arch/powerpc/net/bpf_jit_comp64.c

+6 −2
Original line number Diff line number Diff line
@@ -206,7 +206,7 @@ void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, u64 fun 
	EMIT(PPC_RAW_BCTRL());

}



static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)

static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)

{

	/*

	 * By now, the eBPF program has already setup parameters in r3, r4 and r5
@@ -267,7 +267,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 
	bpf_jit_emit_common_epilogue(image, ctx);



	EMIT(PPC_RAW_BCTR());



	/* out: */

	return 0;

}



/* Assemble the body code between the prologue & epilogue */
@@ -993,7 +995,9 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context * 
		 */

		case BPF_JMP | BPF_TAIL_CALL:

			ctx->seen |= SEEN_TAILCALL;

			bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);

			ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);

			if (ret < 0)

				return ret;

			break;



		default: