Patch "bpf: Clear zext_dst of dead insns" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Clear zext_dst of dead insns

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-clear-zext_dst-of-dead-insns.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e91a1f9dff88ab4f599a736c3e1eaec73d5f4c72
Author: Ilya Leoshkevich <iii@xxxxxxxxxxxxx>
Date:   Thu Aug 12 17:18:10 2021 +0200

    bpf: Clear zext_dst of dead insns
    
    [ Upstream commit 45c709f8c71b525b51988e782febe84ce933e7e0 ]
    
    "access skb fields ok" verifier test fails on s390 with the "verifier
    bug. zext_dst is set, but no reg is defined" message. The first insns
    of the test prog are ...
    
       0:   61 01 00 00 00 00 00 00         ldxw %r0,[%r1+0]
       8:   35 00 00 01 00 00 00 00         jge %r0,0,1
      10:   61 01 00 08 00 00 00 00         ldxw %r0,[%r1+8]
    
    ... and the 3rd one is dead (this does not look intentional to me, but
    this is a separate topic).
    
    sanitize_dead_code() converts dead insns into "ja -1", but keeps
    zext_dst. When opt_subreg_zext_lo32_rnd_hi32() tries to parse such
    an insn, it sees this discrepancy and bails. This problem can be seen
    only with JITs whose bpf_jit_needs_zext() returns true.
    
    Fix by clearning dead insns' zext_dst.
    
    The commits that contributed to this problem are:
    
    1. 5aa5bd14c5f8 ("bpf: add initial suite for selftests"), which
       introduced the test with the dead code.
    2. 5327ed3d44b7 ("bpf: verifier: mark verified-insn with
       sub-register zext flag"), which introduced the zext_dst flag.
    3. 83a2881903f3 ("bpf: Account for BPF_FETCH in
       insn_has_def32()"), which introduced the sanity check.
    4. 9183671af6db ("bpf: Fix leakage under speculation on
       mispredicted branches"), which bisect points to.
    
    It's best to fix this on stable branches that contain the second one,
    since that's the point where the inconsistency was introduced.
    
    Fixes: 5327ed3d44b7 ("bpf: verifier: mark verified-insn with sub-register zext flag")
    Signed-off-by: Ilya Leoshkevich <iii@xxxxxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20210812151811.184086-2-iii@xxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ce1e9193365f..1410f128c404 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10705,6 +10705,7 @@ static void sanitize_dead_code(struct bpf_verifier_env *env)
 		if (aux_data[i].seen)
 			continue;
 		memcpy(insn + i, &trap, sizeof(trap));
+		aux_data[i].zext_dst = false;
 	}
 }