From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227WeytAjZuw9osase4RHd1VVJB7t6ckXlEKj4cDS9tywzoHnsy0A/QHk3Duo7mipTLj9EED ARC-Seal: i=1; a=rsa-sha256; t=1517256714; cv=none; d=google.com; s=arc-20160816; b=RE/3ytsRy3ccnLt65hh1pc4p7lGIthyzeKsFty6BzCcX0If2GQ7OjCsB12TBNHk8Cp pzoblWqldFVv5SxgNbekXgQK9u7MjDsPp+zQXVm/Y/epIy0f0pxWWDQQfsGlhnTUyA1V wdjumixsNMnOe2BmyoIOzwv+tc7eQOt0V2c2z3E2Gt7mh1InoR4cRCXUvGLA+1ozVlNC cf0OGST7aBryjdJEZGD/vS9LjmsQ3jLDXvIDB1pE6AE4QZXfJtZFbCIz+Gn/JcG21hKy NzvwuRueiFG1Yy6dyroJLQfRLRuGVaRCB4D56jas1zkAvl1XQmg2PIxfDpraR1rZWHj2 bizA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=58i1s5jfejds8ZOWng5cpx06YkbMK9xWDAZxSQmb794=; b=w9Zm8OTgOnB/zetVRFP38Cm1fodoY9N03DDQV++l9Gm/dzhy1b82wRirIoUa4pO4sT 1oSgNTh7Fl8jj6MbIoLJ3clJbH38FWrkmCb/H4A3vsbmAJMobNWM6VWEAmFf8CfS/3Yx 7cRrdiRfFfPFLR76oOtbRyi1LFR4Kq6HVxjvB7gUpMeoJrldy7QcYYBDVK6YmAq+jEhJ D6G5thXkEVD5x1gT/eXQERRUs6Kvx2ctEkUhgozzbNem5Ncrh/OwhauHnfDSYdufXuYF jZzmzZ4wj+eoEsJLndgm1qzRLb6oro5jTvahtQbcqJkDySaUXevZOQP6hwGTRokBNxK+ Fe1g== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "ast@kernel.org, stable@vger.kernel.org, Daniel Borkmann" , syzbot+48340bb518e88849e2e3@syzkaller.appspotmail.com, Alexei Starovoitov , Daniel Borkmann Subject: [PATCH 4.9 65/66] bpf: fix 32-bit divide by zero Date: Mon, 29 Jan 2018 13:57:29 +0100 Message-Id: <20180129123843.327495672@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123839.842860149@linuxfoundation.org> References: <20180129123839.842860149@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958976394718299?= X-GMAIL-MSGID: =?utf-8?q?1590958976394718299?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alexei Starovoitov [ upstream commit 68fda450a7df51cff9e5a4d4a4d9d0d5f2589153 ] due to some JITs doing if (src_reg == 0) check in 64-bit mode for div/mod operations mask upper 32-bits of src register before doing the check Fixes: 622582786c9e ("net: filter: x86: internal BPF JIT") Fixes: 7a12b5031c6b ("sparc64: Add eBPF JIT.") Reported-by: syzbot+48340bb518e88849e2e3@syzkaller.appspotmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/verifier.c | 18 ++++++++++++++++++ net/core/filter.c | 4 ++++ 2 files changed, 22 insertions(+) --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3391,6 +3391,24 @@ static int fixup_bpf_calls(struct bpf_ve for (i = 0; i < insn_cnt; i++, insn++) { + if (insn->code == (BPF_ALU | BPF_MOD | BPF_X) || + insn->code == (BPF_ALU | BPF_DIV | BPF_X)) { + /* due to JIT bugs clear upper 32-bits of src register + * before div/mod operation + */ + insn_buf[0] = BPF_MOV32_REG(insn->src_reg, insn->src_reg); + insn_buf[1] = *insn; + cnt = 2; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + if (insn->code != (BPF_JMP | BPF_CALL)) continue; --- a/net/core/filter.c +++ b/net/core/filter.c @@ -441,6 +441,10 @@ do_pass: convert_bpf_extensions(fp, &insn)) break; + if (fp->code == (BPF_ALU | BPF_DIV | BPF_X) || + fp->code == (BPF_ALU | BPF_MOD | BPF_X)) + *insn++ = BPF_MOV32_REG(BPF_REG_X, BPF_REG_X); + *insn = BPF_RAW_INSN(fp->code, BPF_REG_A, BPF_REG_X, 0, fp->k); break;