From patchwork Fri Oct 18 22:16:43 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Collingbourne X-Patchwork-Id: 13842471 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 54154D3F2BE for ; Fri, 18 Oct 2024 22:18:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:Cc:To:From: Subject:Mime-Version:Message-Id:Date:Reply-To:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=npXDHMSv/CnwNU6GVsVemHWtoPO/0w0MZGCZikvlWco=; b=X3SlH7/nVjt05fIuq2684IRWt2 jvwVhDpKe6+eR1TgwYQhLK6/6YO8N6DTkZvbSXedGZmWotLObxD+m7U/7gdFbKKolb70JvvSQAc3S jHTecP3hkhLJ39OBFmSCTfYHEfxYIQ5QT2aoES7ncsjnqXyCHj4uyXVVFvn6P/4o5ENYMn9ouYxk2 ZjvlFJtVtMU51StrMnw5bY+g2Pfj7H03FdLxqy1AbPk58+smrpF+pP7BYVEC0tbuVXSPnKFajKPGd gDGrydCct1x/RDDHcpkc5NAN2HMH7zxdMMJB5vAMmvGqjK2iIhfHjrFifVO8KBwdTF+DGLQrbJMWl BHzgSS1g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1t1vIk-00000002AVb-2Q1u; Fri, 18 Oct 2024 22:18:30 +0000 Received: from mail-yw1-x114a.google.com ([2607:f8b0:4864:20::114a]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1t1vHH-00000002ANK-32js for linux-arm-kernel@lists.infradead.org; Fri, 18 Oct 2024 22:17:01 +0000 Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-6e35199eb2bso47104817b3.3 for ; Fri, 18 Oct 2024 15:16:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1729289818; x=1729894618; darn=lists.infradead.org; h=cc:to:from:subject:mime-version:message-id:date:from:to:cc:subject :date:message-id:reply-to; bh=npXDHMSv/CnwNU6GVsVemHWtoPO/0w0MZGCZikvlWco=; b=cpULt2gt2nIMz8z3/sljTdDwtb/VddDM4SF1mmq0s/0/5KbzYLAdZbLHsYlS5HolrY ENjBClTaBI+BHh/KFKh5p2ZgVa7K9kAjIl0tS9M+6GznzqesP9UV651b2m33vf2mJv1K FgQxiCLIPPlmAaJ+Osi/r8zezr8vmNzFDD0HetP3l6BC5vrvYMJOhxL7PJpHqP3GBNnO eQtlj0h++r5QVr9lHry2f5f87Jdo7XO2i7dFhEeUwOlv/iyvx1zLIRlR93pJuEFPGpWX uQsPPICM9sF4IPjADobo3hO9lpYjgCziLMPZadT6RlBv1NuU0udAJjnu5kUDuuL2K/PK n33A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729289818; x=1729894618; h=cc:to:from:subject:mime-version:message-id:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=npXDHMSv/CnwNU6GVsVemHWtoPO/0w0MZGCZikvlWco=; b=T08DmLwYWPHGyRYrafhFKsPiJYNglrnVl6D2vjJIt5QKuzB2S5XUbf68mVFideXW1v EInrqTfv17EOsv8JczagQ7ttqSba5yhOMFcgcm0B0hWGS5wFaZsUIUUPGUUWeKn6PX8l lYSDaVrSl0CBKPvM+INJedKwumav8xUSGgqRA4Oc9OeQKzp0i1kokpHjOiL1SoT8bz/Z KmWDxuh3EfeU42FgM2ZeULytWKZpvE6onegAvMJhZfF/TecxekBMjh0cwLAnib5j5xKG iidJmVFXy1ISGv//GOqTDR7JKiWruML76onpEUoVVgPlRprJwy2hiebu+D7qBJ2hehMP TydA== X-Forwarded-Encrypted: i=1; AJvYcCXWg58YZvlHKt465dKOOqIl3mccoZ8RqqKijdJ2j7NjZ+dEMf3wj0Zym1yaqbSgcjQUj0Etv5GjvVfXVHxBrdcj@lists.infradead.org X-Gm-Message-State: AOJu0YxJ4SHKMyA1QEX1za6xu9kzpG8j96pVnv2HuUaz/TnfjhUWyqM6 Jrg0OmWbrNabpBjt0/LpsrDX5XuNvE9AfBys0LtU62f5ZJdGvhfdmxU7hEm2BfGwMA== X-Google-Smtp-Source: AGHT+IFHeCLo+UCtERsEqzbRLgjZenIz+8k2uno+X8uTWXAtOqF45NyQP3lRq9DEGuT5C41T1b8dP2k= X-Received: from pcc-desktop.svl.corp.google.com ([2620:15c:2d3:205:7e76:f201:fc01:a9c9]) (user=pcc job=sendgmr) by 2002:a25:86cc:0:b0:e28:ee55:c3d with SMTP id 3f1490d57ef6-e2bb11a8d59mr6530276.1.1729289817688; Fri, 18 Oct 2024 15:16:57 -0700 (PDT) Date: Fri, 18 Oct 2024 15:16:43 -0700 Message-Id: <20241018221644.3240898-1-pcc@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.47.0.rc1.288.g06298d1525-goog Subject: [PATCH] bpf, arm64: Fix address emission with tag-based KASAN enabled From: Peter Collingbourne To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Puranjay Mohan , Xu Kuohai , Catalin Marinas , Will Deacon , Jean-Philippe Brucker , bpf@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Peter Collingbourne , Alexander Potapenko , Andrey Konovalov , stable@vger.kernel.org X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20241018_151659_785825_21F2B385 X-CRM114-Status: GOOD ( 15.12 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission. Fixes: 19d3c179a377 ("bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG") Signed-off-by: Peter Collingbourne Link: https://linux-review.googlesource.com/id/I1496f2bc24fba7a1d492e16e2b94cf43714f2d3c Cc: stable@vger.kernel.org Acked-by: Xu Kuohai --- arch/arm64/net/bpf_jit_comp.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 8bbd0b20136a8..5db82bfc9dc11 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -2220,7 +2220,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx); if (flags & BPF_TRAMP_F_CALL_ORIG) { - emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + /* for the first pass, assume the worst case */ + if (!ctx->image) + ctx->idx += 4; + else + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_enter, ctx); } @@ -2264,7 +2268,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, if (flags & BPF_TRAMP_F_CALL_ORIG) { im->ip_epilogue = ctx->ro_image + ctx->idx; - emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + /* for the first pass, assume the worst case */ + if (!ctx->image) + ctx->idx += 4; + else + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_exit, ctx); }