linux/arch/powerpc/net
Daniel Borkmann d269176e76 bpf, ppc64: fix out of bounds access in tail call
While working on 16338a9b3a ("bpf, arm64: fix out of bounds access in
tail call") I noticed that ppc64 JIT is partially affected as well. While
the bound checking is correctly performed as unsigned comparison, the
register with the index value however, is never truncated into 32 bit
space, so e.g. a index value of 0x100000000ULL with a map of 1 element
would pass with PPC_CMPLW() whereas we later on continue with the full
64 bit register value. Therefore, as we do in interpreter and other JITs
truncate the value to 32 bit initially in order to fix access.

Fixes: ce0761419f ("powerpc/bpf: Implement support for tail calls")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Tested-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-02-26 19:58:09 -08:00
..
bpf_jit32.h powerpc/bpf/jit: Isolate classic BPF JIT specifics into a separate header 2016-06-24 15:15:51 +10:00
bpf_jit64.h bpf: take advantage of stack_depth tracking in powerpc JIT 2017-11-06 16:48:16 +11:00
bpf_jit_asm64.S powerpc/ebpf/jit: Implement JIT compiler for extended BPF 2016-06-24 15:17:57 +10:00
bpf_jit_asm.S powerpc/bpf/jit: Isolate classic BPF JIT specifics into a separate header 2016-06-24 15:15:51 +10:00
bpf_jit_comp64.c bpf, ppc64: fix out of bounds access in tail call 2018-02-26 19:58:09 -08:00
bpf_jit_comp.c bpf: get rid of pure_initcall dependency to enable jits 2018-01-19 18:37:00 -08:00
bpf_jit.h bpf, ppc64: implement jiting of BPF_J{LT, LE, SLT, SLE} 2017-08-09 16:53:57 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00