Remove BUG_ON() if the shift immediate is >=32 to avoid kernel crashes due to malicious user input. Since the micro-assembler will not allow an immediate greater or equal to 32, we will use the maximum value which is 31. This will do the correct thing on either 32- or 64-bit cores since no 64-bit instructions are being used in JIT. Cc: "David S. Miller" <davem@xxxxxxxxxxxxx> Cc: Daniel Borkmann <dborkman@xxxxxxxxxx> Cc: Alexei Starovoitov <ast@xxxxxxxxxxxx> Cc: netdev@xxxxxxxxxxxxxxx Signed-off-by: Markos Chandras <markos.chandras@xxxxxxxxxx> --- arch/mips/net/bpf_jit.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c index 1bcd599d9971..09ebc886c7aa 100644 --- a/arch/mips/net/bpf_jit.c +++ b/arch/mips/net/bpf_jit.c @@ -309,7 +309,8 @@ static inline void emit_sll(unsigned int dst, unsigned int src, unsigned int sa, struct jit_ctx *ctx) { /* sa is 5-bits long */ - BUG_ON(sa >= BIT(5)); + if (sa >= BIT(5)) + sa = BIT(5) - 1; emit_instr(ctx, sll, dst, src, sa); } @@ -323,7 +324,8 @@ static inline void emit_srl(unsigned int dst, unsigned int src, unsigned int sa, struct jit_ctx *ctx) { /* sa is 5-bits long */ - BUG_ON(sa >= BIT(5)); + if (sa >= BIT(5)) + sa = BIT(5) - 1; emit_instr(ctx, srl, dst, src, sa); } -- 2.0.0