Unverified Commit 72a9f7a5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9316 CVE-2022-48755 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yuntao Liu <liuyuntao12@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/AWQL3SLJCKP36AADAW6HHTNFEOXDTNPF/ 
CVE-2022-48755

Naveen N. Rao (1):
  [Backport] powerpc64/bpf: Limit 'ldbrx' to processors compliant with
    ISA v2.06


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IA72FY 
 
Link:https://gitee.com/openeuler/kernel/pulls/9316

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents f74cd8cc 4c8d57b8

arch/powerpc/net/bpf_jit_comp64.c

+14 −10
Original line number Diff line number Diff line
@@ -592,17 +592,21 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, 
				PPC_MR(dst_reg, b2p[TMP_REG_1]);

				break;

			case 64:

				/*

				 * Way easier and faster(?) to store the value

				 * into stack and then use ldbrx

				 *

				 * ctx->seen will be reliable in pass2, but

				 * the instructions generated will remain the

				 * same across all passes

				 */

				/* Store the value to stack and then use byte-reverse loads */

				PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx));

				PPC_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx));

				PPC_LDBRX(dst_reg, 0, b2p[TMP_REG_1]);

				EMIT(PPC_RAW_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx)));

				if (cpu_has_feature(CPU_FTR_ARCH_206)) {

					EMIT(PPC_RAW_LDBRX(dst_reg, 0, b2p[TMP_REG_1]));

				} else {

					EMIT(PPC_RAW_LWBRX(dst_reg, 0, b2p[TMP_REG_1]));

					if (IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN))

						EMIT(PPC_RAW_SLDI(dst_reg, dst_reg, 32));

					EMIT(PPC_RAW_LI(b2p[TMP_REG_2], 4));

					EMIT(PPC_RAW_LWBRX(b2p[TMP_REG_2], b2p[TMP_REG_2], b2p[TMP_REG_1]));

					if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))

						EMIT(PPC_RAW_SLDI(b2p[TMP_REG_2], b2p[TMP_REG_2], 32));

					EMIT(PPC_RAW_OR(dst_reg, dst_reg, b2p[TMP_REG_2]));

				}

				break;

			}

			break;