On 11/03/23 3:46 pm, Christophe Leroy wrote:
Le 09/03/2023 à 19:02, Hari Bathini a écrit :Use bpf_jit_binary_pack_alloc in powerpc jit. The jit engine first writes the program to the rw buffer. When the jit is done, the program is copied to the final location with bpf_jit_binary_pack_finalize. With multiple jit_subprogs, bpf_jit_free is called on some subprograms that haven't got bpf_jit_binary_pack_finalize() yet. Implement custom bpf_jit_free() like in commit 1d5f82d9dd47 ("bpf, x86: fix freeing of not-finalized bpf_prog_pack") to call bpf_jit_binary_pack_finalize(), if necessary. While here, correct the misnomer powerpc64_jit_data to powerpc_jit_data as it is meant for both ppc32 and ppc64.root@vgoip:~# echo 1 > /proc/sys/net/core/bpf_jit_enable root@vgoip:~# insmod test_bpf.ko [ 570.270983] kernel tried to execute exec-protected page (bd42c198) - exploit attempt? (uid: 0) [ 570.279414] BUG: Unable to handle kernel instruction fetch [ 570.284822] Faulting instruction address: 0xbd42c198 [ 570.289734] Oops: Kernel access of bad area, sig: 11 [#1] [ 570.295062] BE PAGE_SIZE=16K PREEMPT CMPC885 [ 570.302811] Modules linked in: test_bpf(+) test_module [ 570.307891] CPU: 0 PID: 559 Comm: insmod Not tainted 6.3.0-rc1-s3k-dev-g4ae0418b3500 #258 [ 570.315975] Hardware name: MIAE 8xx 0x500000 CMPC885 [ 570.320882] NIP: bd42c198 LR: be8180ec CTR: be818010 [ 570.325873] REGS: cae2bc40 TRAP: 0400 Not tainted (6.3.0-rc1-s3k-dev-g4ae0418b3500) [ 570.333704] MSR: 40009032 <EE,ME,IR,DR,RI> CR: 88008222 XER: 00000000 [ 570.340503] [ 570.340503] GPR00: be806eac cae2bd00 c2977340 00000000 c2c40900 00000000 c1a18a80 00000000 [ 570.340503] GPR08: 00000002 00000001 00000000 00000000 ffffffff 100d815e ca6a0000 00000001 [ 570.340503] GPR16: 1234aaaa ca242250 c1180000 00000001 1234aaab c9050030 00000000 00000000 [ 570.340503] GPR24: c2c40900 00000000 ffffffff 00000000 c1a18a80 00000000 00000002 ca24225c [ 570.376819] NIP [bd42c198] 0xbd42c198 [ 570.380436] LR [be8180ec] 0xbe8180ec [ 570.383965] Call Trace: [ 570.386373] [cae2bd00] [0000000b] 0xb (unreliable) [ 570.391107] [cae2bd50] [be806eac] __run_one+0x58/0x224 [test_bpf] [ 570.397390] [cae2bd90] [be80ca94] test_bpf_init+0x8d8/0x1010 [test_bpf] [ 570.404189] [cae2be20] [c00049f0] do_one_initcall+0x38/0x1e4 [ 570.409782] [cae2be80] [c0090aa8] do_init_module+0x50/0x234 [ 570.415291] [cae2bea0] [c0092e08] sys_finit_module+0xb4/0xf8 [ 570.420884] [cae2bf20] [c000e344] system_call_exception+0x94/0x150 [ 570.426995] [cae2bf30] [c00120a8] ret_from_syscall+0x0/0x28 [ 570.432502] --- interrupt: c00 at 0xfd5fca0 [ 570.436632] NIP: 0fd5fca0 LR: 10014568 CTR: 10013294 [ 570.441625] REGS: cae2bf40 TRAP: 0c00 Not tainted (6.3.0-rc1-s3k-dev-g4ae0418b3500) [ 570.449455] MSR: 0000d032 <EE,PR,ME,IR,DR,RI> CR: 44002224 XER: 00000000 [ 570.456513] [ 570.456513] GPR00: 00000161 7f868d30 77ed34d0 00000003 100bc4ef 00000000 0fd51868 0000d032 [ 570.456513] GPR08: 000007b1 10013294 00000000 00000002 52454753 100d815e 100a44b8 00000000 [ 570.456513] GPR16: 100d167c 100b0000 1198426c 119854cd 100d0000 100d0000 00000000 100a4498 [ 570.456513] GPR24: ffffffa2 ffffffff 11984244 00000003 1198426c 100bc4ef 11984288 1198426c [ 570.492828] NIP [0fd5fca0] 0xfd5fca0 [ 570.496358] LR [10014568] 0x10014568 [ 570.499887] --- interrupt: c00 [ 570.502902] Code: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX [ 570.517973] ---[ end trace 0000000000000000 ]--- [ 570.522523] [ 570.523986] note: insmod[559] exited with irqs disabled Segmentation fault
Thanks a lot for reviewing v2, Christophe. Posted v3 for reviewing.. Thanks Hari
