mbox series

[RESEND,bpf,v2,0/2] x86/bpf: Fixes for the BPF JIT with retbleed=stuff

Message ID 20240401185821.224068-1-ubizjak@gmail.com (mailing list archive)
Headers show
Series x86/bpf: Fixes for the BPF JIT with retbleed=stuff | expand

Message

Uros Bizjak April 1, 2024, 6:55 p.m. UTC
From: Joan Bruguera Micó <joanbrugueram@gmail.com>

Fixes two issues that cause kernels panic when using the BPF JIT with
the call depth tracking / stuffing mitigation for Skylake processors
(`retbleed=stuff`). Both issues can be triggered by running simple
BPF programs (e.g. running the test suite should trigger both).

The first (resubmit) fixes a trivial issue related to calculating the
destination IP for call instructions with call depth tracking.

The second is related to using the correct IP for relocations, related
to the recently introduced %rip-relative addressing for PER_CPU_VAR.

Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
---
v2:
  Simplify calculation of "ip".
  Add more details to the commit message.

Joan Bruguera Micó (1):
  x86/bpf: Fix IP for relocating call depth accounting

Uros Bizjak (1):
  x86/bpf: Fix IP after emitting call depth accounting

 arch/x86/include/asm/alternative.h |  4 ++--
 arch/x86/kernel/callthunks.c       |  4 ++--
 arch/x86/net/bpf_jit_comp.c        | 19 ++++++++-----------
 3 files changed, 12 insertions(+), 15 deletions(-)

Comments

patchwork-bot+netdevbpf@kernel.org April 2, 2024, 4:10 a.m. UTC | #1
Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Mon,  1 Apr 2024 20:55:28 +0200 you wrote:
> From: Joan Bruguera Micó <joanbrugueram@gmail.com>
> 
> Fixes two issues that cause kernels panic when using the BPF JIT with
> the call depth tracking / stuffing mitigation for Skylake processors
> (`retbleed=stuff`). Both issues can be triggered by running simple
> BPF programs (e.g. running the test suite should trigger both).
> 
> [...]

Here is the summary with links:
  - [RESEND,bpf,v2,1/2] x86/bpf: Fix IP after emitting call depth accounting
    https://git.kernel.org/bpf/bpf/c/9d98aa088386
  - [RESEND,bpf,v2,2/2] x86/bpf: Fix IP for relocating call depth accounting
    https://git.kernel.org/bpf/bpf/c/6a537453000a

You are awesome, thank you!
Ingo Molnar April 3, 2024, 7:26 a.m. UTC | #2
* patchwork-bot+netdevbpf@kernel.org <patchwork-bot+netdevbpf@kernel.org> wrote:

> Hello:
> 
> This series was applied to bpf/bpf.git (master)
> by Alexei Starovoitov <ast@kernel.org>:
> 
> On Mon,  1 Apr 2024 20:55:28 +0200 you wrote:
> > From: Joan Bruguera Micó <joanbrugueram@gmail.com>
> > 
> > Fixes two issues that cause kernels panic when using the BPF JIT with
> > the call depth tracking / stuffing mitigation for Skylake processors
> > (`retbleed=stuff`). Both issues can be triggered by running simple
> > BPF programs (e.g. running the test suite should trigger both).
> > 
> > [...]
> 
> Here is the summary with links:
>   - [RESEND,bpf,v2,1/2] x86/bpf: Fix IP after emitting call depth accounting
>     https://git.kernel.org/bpf/bpf/c/9d98aa088386
>   - [RESEND,bpf,v2,2/2] x86/bpf: Fix IP for relocating call depth accounting
>     https://git.kernel.org/bpf/bpf/c/6a537453000a

Just wondering, which kernel version is this targeted for?

The bug is upstream as well, so a fix needs to be sent to Linus.

I can pick all of this up into tip:x86/urgent, if that accelerates 
things.

Thanks,

	Ingo
Uros Bizjak April 3, 2024, 7:43 a.m. UTC | #3
On Wed, Apr 3, 2024 at 9:26 AM Ingo Molnar <mingo@kernel.org> wrote:
>
>
> * patchwork-bot+netdevbpf@kernel.org <patchwork-bot+netdevbpf@kernel.org> wrote:
>
> > Hello:
> >
> > This series was applied to bpf/bpf.git (master)
> > by Alexei Starovoitov <ast@kernel.org>:
> >
> > On Mon,  1 Apr 2024 20:55:28 +0200 you wrote:
> > > From: Joan Bruguera Micó <joanbrugueram@gmail.com>
> > >
> > > Fixes two issues that cause kernels panic when using the BPF JIT with
> > > the call depth tracking / stuffing mitigation for Skylake processors
> > > (`retbleed=stuff`). Both issues can be triggered by running simple
> > > BPF programs (e.g. running the test suite should trigger both).
> > >
> > > [...]
> >
> > Here is the summary with links:
> >   - [RESEND,bpf,v2,1/2] x86/bpf: Fix IP after emitting call depth accounting
> >     https://git.kernel.org/bpf/bpf/c/9d98aa088386
> >   - [RESEND,bpf,v2,2/2] x86/bpf: Fix IP for relocating call depth accounting
> >     https://git.kernel.org/bpf/bpf/c/6a537453000a
>
> Just wondering, which kernel version is this targeted for?

The whole series is intended for the current mainline (v6.9), this is
why it is developed against the bpf (*not* bpf-next) branch. Please
note that the kernel panics with retbleed=stuff even without
%rip-relative changes (patch 1/2 above) [1], so patch 1/2 should be
backported to stable branches.

[1] https://lore.kernel.org/lkml/20230105214922.250473-1-joanbrugueram@gmail.com/

Uros.

> The bug is upstream as well, so a fix needs to be sent to Linus.
>
> I can pick all of this up into tip:x86/urgent, if that accelerates
> things.
>
> Thanks,
>
>         Ingo
Ingo Molnar April 3, 2024, 8:01 a.m. UTC | #4
* Uros Bizjak <ubizjak@gmail.com> wrote:

> > > Here is the summary with links:
> > >   - [RESEND,bpf,v2,1/2] x86/bpf: Fix IP after emitting call depth accounting
> > >     https://git.kernel.org/bpf/bpf/c/9d98aa088386
> > >   - [RESEND,bpf,v2,2/2] x86/bpf: Fix IP for relocating call depth accounting
> > >     https://git.kernel.org/bpf/bpf/c/6a537453000a
> >
> > Just wondering, which kernel version is this targeted for?
> 
> The whole series is intended for the current mainline (v6.9), this is 
> why it is developed against the bpf (*not* bpf-next) branch.

I see - so bpf.git:master are current-mainline BPF fixes - that's perfect.

BTW., bpf-next is not a branch, but a separate Git tree. (Which is what 
confused me.)

Thanks,

	Ingo
Daniel Borkmann April 3, 2024, 9:04 a.m. UTC | #5
On 4/3/24 10:01 AM, Ingo Molnar wrote:
> * Uros Bizjak <ubizjak@gmail.com> wrote:
> 
>>>> Here is the summary with links:
>>>>    - [RESEND,bpf,v2,1/2] x86/bpf: Fix IP after emitting call depth accounting
>>>>      https://git.kernel.org/bpf/bpf/c/9d98aa088386
>>>>    - [RESEND,bpf,v2,2/2] x86/bpf: Fix IP for relocating call depth accounting
>>>>      https://git.kernel.org/bpf/bpf/c/6a537453000a
>>>
>>> Just wondering, which kernel version is this targeted for?
>>
>> The whole series is intended for the current mainline (v6.9), this is
>> why it is developed against the bpf (*not* bpf-next) branch.
> 
> I see - so bpf.git:master are current-mainline BPF fixes - that's perfect.

Yes, correct, that is for mainline (v6.9).

Thanks,
Daniel