android_kernel_msm-6.1_noth.../kernel/bpf
Yonghong Song 15db682980 bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4
commit dfce9cb3140592b886838e06f3e0c25fea2a9cae upstream.

Bpf cpu=v4 support is introduced in [1] and Commit 4cd58e9af8b9
("bpf: Support new 32bit offset jmp instruction") added support for new
32bit offset jmp instruction. Unfortunately, in function
bpf_adj_delta_to_off(), for new branch insn with 32bit offset, the offset
(plus/minor a small delta) compares to 16-bit offset bound
[S16_MIN, S16_MAX], which caused the following verification failure:
  $ ./test_progs-cpuv4 -t verif_scale_pyperf180
  ...
  insn 10 cannot be patched due to 16-bit range
  ...
  libbpf: failed to load object 'pyperf180.bpf.o'
  scale_test:FAIL:expect_success unexpected error: -12 (errno 12)
  #405     verif_scale_pyperf180:FAIL

Note that due to recent llvm18 development, the patch [2] (already applied
in bpf-next) needs to be applied to bpf tree for testing purpose.

The fix is rather simple. For 32bit offset branch insn, the adjusted
offset compares to [S32_MIN, S32_MAX] and then verification succeeded.

  [1] https://lore.kernel.org/all/20230728011143.3710005-1-yonghong.song@linux.dev
  [2] https://lore.kernel.org/bpf/20231110193644.3130906-1-yonghong.song@linux.dev

Fixes: 4cd58e9af8b9 ("bpf: Support new 32bit offset jmp instruction")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231201024640.3417057-1-yonghong.song@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-10 17:10:36 +01:00
..
preload bpf: iterators: Build and use lightweight bootstrap version of bpftool 2022-07-15 12:01:30 -07:00
arraymap.c bpf: Fix prog_array_map_poke_run map poke update 2024-01-01 12:38:52 +00:00
bloom_filter.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
bpf_inode_storage.c bpf: Compute map_btf_id during build time 2022-04-26 11:35:21 -07:00
bpf_iter.c bpf: Initialize the bpf_run_ctx in bpf_iter_run_prog() 2022-08-18 17:06:13 -07:00
bpf_local_storage.c bpf: Annotate data races in bpf_local_storage 2023-05-24 17:32:36 +01:00
bpf_lru_list.c bpf: Address KCSAN report on bpf_lru_list 2023-07-27 08:50:34 +02:00
bpf_lru_list.h bpf: Address KCSAN report on bpf_lru_list 2023-07-27 08:50:34 +02:00
bpf_lsm.c bpf: Fix the kernel crash caused by bpf_setsockopt(). 2023-02-09 11:28:02 +01:00
bpf_struct_ops.c bpf: Remove is_valid_bpf_tramp_flags() 2022-07-11 21:04:58 +02:00
bpf_struct_ops_types.h
bpf_task_storage.c bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy 2022-09-01 12:16:12 -07:00
btf.c bpf: Fix an error in verifying a field in a union 2023-09-13 09:42:30 +02:00
cgroup.c bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen 2023-07-19 16:21:05 +02:00
cgroup_iter.c cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers 2023-06-21 16:00:51 +02:00
core.c bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4 2024-01-10 17:10:36 +01:00
cpumap.c bpf, cpumap: Make sure kthread is running before map update returns 2023-08-11 12:08:23 +02:00
devmap.c bpf: Use bpf_map_area_alloc consistently on bpf map creation 2022-08-10 11:50:43 -07:00
disasm.c
disasm.h
dispatcher.c bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE() 2022-11-07 16:07:35 -08:00
hashtab.c bpf: Fix unnecessary -EBUSY from htab_lock_bucket 2023-11-20 11:51:55 +01:00
helpers.c bpf: Check map->usercnt after timer->timer is assigned 2023-11-20 11:52:15 +01:00
inode.c
Kconfig rcu: Make the TASKS_RCU Kconfig option be selected 2022-04-20 16:52:58 -07:00
link_iter.c bpf: Add bpf_link iterator 2022-05-10 11:20:45 -07:00
local_storage.c cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers 2023-06-21 16:00:51 +02:00
lpm_trie.c bpf: Use bpf_map_area_alloc consistently on bpf map creation 2022-08-10 11:50:43 -07:00
Makefile bpf: Introduce any context BPF specific memory allocator. 2022-09-05 15:33:05 +02:00
map_in_map.c bpf: Fix elem_size not being set for inner maps 2023-06-14 11:15:17 +02:00
map_in_map.h
map_iter.c
memalloc.c bpf: Zeroing allocated object from slab in bpf memory allocator 2023-03-10 09:33:06 +01:00
mmap_unlock_work.h
net_namespace.c
offload.c bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD 2023-01-24 07:24:37 +01:00
percpu_freelist.c bpf: Initialize same number of free nodes for each pcpu_freelist 2022-11-11 12:05:14 -08:00
percpu_freelist.h
prog_iter.c
queue_stack_maps.c bpf: Avoid deadlock when using queue and stack maps from NMI 2023-10-06 14:56:35 +02:00
reuseport_array.c net: Fix suspicious RCU usage in bpf_sk_reuseport_detach() 2022-08-17 16:42:59 -07:00
ringbuf.c bpf: Add bpf_user_ringbuf_drain() helper 2022-09-21 16:24:58 -07:00
stackmap.c perf/bpf: Always use perf callchains if exist 2022-09-13 15:03:22 +02:00
syscall.c bpf: Assign bpf_tramp_run_ctx::saved_run_ctx before recursion check. 2023-09-19 12:28:03 +02:00
sysfs_btf.c
task_iter.c bpf: keep a reference to the mm, in case the task is dead. 2023-01-24 07:24:31 +01:00
tnum.c
trampoline.c bpf, x64: Fix tailcall infinite loop 2024-01-10 17:10:26 +01:00
verifier.c bpf: fix precision backtracking instruction iteration 2024-01-10 17:10:29 +01:00