Commit 66a28d2d authored Aug 19, 2024 by Puranjay Mohan Committed by Tengda Wu Aug 19, 2024

bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG

mainline inclusion
from mainline-v6.11-rc1
commit 19d3c179a37730caf600a97fed3794feac2b197b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ62
CVE: CVE-2024-43840

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d3c179a37730caf600a97fed3794feac2b197b



--------------------------------

When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls
__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them
the struct bpf_tramp_image *im pointer as an argument in R0.

The trampoline generation code uses emit_addr_mov_i64() to emit
instructions for moving the bpf_tramp_image address into R0, but
emit_addr_mov_i64() assumes the address to be in the vmalloc() space
and uses only 48 bits. Because bpf_tramp_image is allocated using
kzalloc(), its address can use more than 48-bits, in this case the
trampoline will pass an invalid address to __bpf_tramp_enter/exit()
causing a kernel crash.

Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()
as it can work with addresses that are greater than 48-bits.

Fixes: efc9909f ("bpf, arm64: Add bpf trampoline for arm64")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Closes: https://lore.kernel.org/all/SJ0PR15MB461564D3F7E7A763498CA6A8CBDB2@SJ0PR15MB4615.namprd15.prod.outlook.com/
Link: https://lore.kernel.org/bpf/20240711151838.43469-1-puranjay@kernel.org



Conflicts:
	arch/arm64/net/bpf_jit_comp.c
[The conflict is due to commit 96b0f5addc7a ("arm64, bpf: Use
bpf_prog_pack for arm64 bpf trampoline"), a perf commit, which
changes ctx->image to ctx->ro_image]
Signed-off-by: Tengda Wu <wutengda2@huawei.com>

parent feb0fe58

arch/arm64/net/bpf_jit_comp.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1640,7 +1640,7 @@ static int prepare_trampoline(struct jit_ctx ctx, struct bpf_tramp_image im,
		emit(A64_STR64I(A64_R(19), A64_SP, regs_off), ctx);

		if (flags & BPF_TRAMP_F_CALL_ORIG) {
		emit_addr_mov_i64(A64_R(0), (const u64)im, ctx);
		emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
		emit_call((const u64)__bpf_tramp_enter, ctx);
		}

		@@ -1681,7 +1681,7 @@ static int prepare_trampoline(struct jit_ctx ctx, struct bpf_tramp_image im,

		if (flags & BPF_TRAMP_F_CALL_ORIG) {
		im->ip_epilogue = ctx->image + ctx->idx;
		emit_addr_mov_i64(A64_R(0), (const u64)im, ctx);
		emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
		emit_call((const u64)__bpf_tramp_exit, ctx);
		}