Commit 251599e1 authored by Zi Shen Lim's avatar Zi Shen Lim Committed by Catalin Marinas
Browse files

arm64: bpf: fix div-by-zero case 



In the case of division by zero in a BPF program:
	A = A / X;  (X == 0)
the expected behavior is to terminate with return value 0.

This is confirmed by the test case introduced in commit 86bf1721
("test_bpf: add tests checking that JIT/interpreter sets A and X to 0.").

Reported-by: default avatarYang Shi <yang.shi@linaro.org>
Tested-by: default avatarYang Shi <yang.shi@linaro.org>
CC: Xi Wang <xi.wang@gmail.com>
CC: Alexei Starovoitov <ast@plumgrid.com>
CC: linux-arm-kernel@lists.infradead.org
CC: linux-kernel@vger.kernel.org
Fixes: e54bcde3 ("arm64: eBPF JIT compiler")
Cc: <stable@vger.kernel.org> # 3.18+
Signed-off-by: default avatarZi Shen Lim <zlim.lnx@gmail.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent 4d17da4c

arch/arm64/net/bpf_jit.h

+2 −1
Original line number Diff line number Diff line 
/*

 * BPF JIT compiler for ARM64

 *

 * Copyright (C) 2014 Zi Shen Lim <zlim.lnx@gmail.com>

 * Copyright (C) 2014-2015 Zi Shen Lim <zlim.lnx@gmail.com>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as
@@ -35,6 +35,7 @@ 
	aarch64_insn_gen_comp_branch_imm(0, offset, Rt, A64_VARIANT(sf), \

		AARCH64_INSN_BRANCH_COMP_##type)

#define A64_CBZ(sf, Rt, imm19) A64_COMP_BRANCH(sf, Rt, (imm19) << 2, ZERO)

#define A64_CBNZ(sf, Rt, imm19) A64_COMP_BRANCH(sf, Rt, (imm19) << 2, NONZERO)



/* Conditional branch (immediate) */

#define A64_COND_BRANCH(cond, offset) \

arch/arm64/net/bpf_jit_comp.c

+25 −12
Original line number Diff line number Diff line 
/*

 * BPF JIT compiler for ARM64

 *

 * Copyright (C) 2014 Zi Shen Lim <zlim.lnx@gmail.com>

 * Copyright (C) 2014-2015 Zi Shen Lim <zlim.lnx@gmail.com>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as
@@ -225,6 +225,17 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) 
	u8 jmp_cond;

	s32 jmp_offset;



#define check_imm(bits, imm) do {				\

	if ((((imm) > 0) && ((imm) >> (bits))) ||		\

	    (((imm) < 0) && (~(imm) >> (bits)))) {		\

		pr_info("[%2d] imm=%d(0x%x) out of range\n",	\

			i, imm, imm);				\

		return -EINVAL;					\

	}							\

} while (0)

#define check_imm19(imm) check_imm(19, imm)

#define check_imm26(imm) check_imm(26, imm)



	switch (code) {

	/* dst = src */

	case BPF_ALU | BPF_MOV | BPF_X:
@@ -258,8 +269,21 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) 
		break;

	case BPF_ALU | BPF_DIV | BPF_X:

	case BPF_ALU64 | BPF_DIV | BPF_X:

	{

		const u8 r0 = bpf2a64[BPF_REG_0];



		/* if (src == 0) return 0 */

		jmp_offset = 3; /* skip ahead to else path */

		check_imm19(jmp_offset);

		emit(A64_CBNZ(is64, src, jmp_offset), ctx);

		emit(A64_MOVZ(1, r0, 0, 0), ctx);

		jmp_offset = epilogue_offset(ctx);

		check_imm26(jmp_offset);

		emit(A64_B(jmp_offset), ctx);

		/* else */

		emit(A64_UDIV(is64, dst, dst, src), ctx);

		break;

	}

	case BPF_ALU | BPF_MOD | BPF_X:

	case BPF_ALU64 | BPF_MOD | BPF_X:

		ctx->tmp_used = 1;
@@ -393,17 +417,6 @@ emit_bswap_uxt: 
		emit(A64_ASR(is64, dst, dst, imm), ctx);

		break;



#define check_imm(bits, imm) do {				\

	if ((((imm) > 0) && ((imm) >> (bits))) ||		\

	    (((imm) < 0) && (~(imm) >> (bits)))) {		\

		pr_info("[%2d] imm=%d(0x%x) out of range\n",	\

			i, imm, imm);				\

		return -EINVAL;					\

	}							\

} while (0)

#define check_imm19(imm) check_imm(19, imm)

#define check_imm26(imm) check_imm(26, imm)



	/* JUMP off */

	case BPF_JMP | BPF_JA:

		jmp_offset = bpf2a64_offset(i + off, i, ctx);

CRA Git | Maintained and supported by SUSTech CRA and CCSE