bpf: handle 32-bit zext during constant blinding
authorNaveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Wed, 21 Aug 2019 19:23:58 +0000 (00:53 +0530)
committerDaniel Borkmann <daniel@iogearbox.net>
Mon, 26 Aug 2019 21:05:01 +0000 (23:05 +0200)
commitede7c460b1da5be7b8ef4efe47f1687babf06408
treee5263710f10a78a6a58716b01eda99dfae0c561a
parent86c28b2d69f93a218a9a5cef146ed0097a98687f
bpf: handle 32-bit zext during constant blinding

Since BPF constant blinding is performed after the verifier pass, the
ALU32 instructions inserted for doubleword immediate loads don't have a
corresponding zext instruction. This is causing a kernel oops on powerpc
and can be reproduced by running 'test_cgroup_storage' with
bpf_jit_harden=2.

Fix this by emitting BPF_ZEXT during constant blinding if
prog->aux->verifier_zext is set.

Fixes: a4b1d3c1ddf6cb ("bpf: verifier: insert zero extension according to analysis result")
Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Reviewed-by: Jiong Wang <jiong.wang@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
kernel/bpf/core.c