• David S. Miller's avatar
    sparc64: Fix BPF JIT wrt. branches and ldimm64 instructions. · e3bf4c61
    David S. Miller authored
    Like other JITs, sparc64 maintains an array of instruction offsets but
    stores the entries off by one.  This is done because jumps to the
    exit block are indexed to one past the last BPF instruction.
    
    So if we size the array by the program length, we need to record
    the previous instruction in order to stay within the array bounds.
    
    This is explained in ARM JIT commit 8eee539d ("arm64: bpf: fix
    out-of-bounds read in bpf2a64_offset()").
    
    But this scheme requires a little bit of careful handling when
    the instruction before the branch destination is a 64-bit load
    immediate.  It takes up 2 BPF instruction slots.
    
    Therefore, we have to fill in the array entry for the second
    half of the 64-bit load immediate instruction rather than for
    the one for the beginning of that instruction.
    
    Fixes: 7a12b503 ("sparc64: Add eBPF JIT.")
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e3bf4c61
bpf_jit_comp_64.c 37.6 KB