riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC
authorPu Lehui <pulehui@huawei.com>
Tue, 6 Dec 2022 09:14:10 +0000 (17:14 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 31 Dec 2022 12:14:16 +0000 (13:14 +0100)
commit52e0d8a8dda316ddd2107481dcf19abd9e9a71a2
treebcb2f320fd7005496eb67d27c7c4bf11aae0a9ff
parent0de70ed675fab2d02093647932d0aef40b6c2612
riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC

[ Upstream commit b54b6003612a376e7be32cbc5c1af3754bbbbb3d ]

For BPF_PSEUDO_FUNC instruction, verifier will refill imm with
correct addresses of bpf_calls and then run last pass of JIT.
Since the emit_imm of RV64 is variable-length, which will emit
appropriate length instructions accorroding to the imm, it may
broke ctx->offset, and lead to unpredictable problem, such as
inaccurate jump. So let's fix it with fixed-length instructions.

Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Suggested-by: Björn Töpel <bjorn@rivosinc.com>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
Link: https://lore.kernel.org/bpf/20221206091410.1584784-1-pulehui@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
arch/riscv/net/bpf_jit_comp64.c