riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC
authorPu Lehui <pulehui@huawei.com>
Tue, 6 Dec 2022 09:14:10 +0000 (17:14 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 31 Dec 2022 12:32:23 +0000 (13:32 +0100)
commitadebac5995c9f75f24ee0c32bcd5f32749ce707e
treec4372009e1e1950ffbc64c74f789f6f2679eace8
parent86c1f5d5f49847f3023d57e9865efac7192c4b5d
riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC

[ Upstream commit b54b6003612a376e7be32cbc5c1af3754bbbbb3d ]

For BPF_PSEUDO_FUNC instruction, verifier will refill imm with
correct addresses of bpf_calls and then run last pass of JIT.
Since the emit_imm of RV64 is variable-length, which will emit
appropriate length instructions accorroding to the imm, it may
broke ctx->offset, and lead to unpredictable problem, such as
inaccurate jump. So let's fix it with fixed-length instructions.

Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Suggested-by: Björn Töpel <bjorn@rivosinc.com>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
Link: https://lore.kernel.org/bpf/20221206091410.1584784-1-pulehui@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
arch/riscv/net/bpf_jit_comp64.c