Patch "bpf, arm64: Fix BTI type used for freplace attached functions" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf, arm64: Fix BTI type used for freplace attached functions

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-arm64-fix-bti-type-used-for-freplace-attached-fu.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0a9f7c72db338d808de8b35708d487940038ce8f
Author: Alexander Duyck <alexanderduyck@xxxxxx>
Date:   Thu Jul 13 09:49:31 2023 -0700

    bpf, arm64: Fix BTI type used for freplace attached functions
    
    [ Upstream commit a3f25d614bc73b45e8f02adc6769876dfd16ca84 ]
    
    When running an freplace attached bpf program on an arm64 system w were
    seeing the following issue:
      Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI
    
    After a bit of work to track it down I determined that what appeared to be
    happening is that the 'bti c' at the start of the program was somehow being
    reached after a 'br' instruction. Further digging pointed me toward the
    fact that the function was attached via freplace. This in turn led me to
    build_plt which I believe is invoking the long jump which is triggering
    this error.
    
    To resolve it we can replace the 'bti c' with 'bti jc' and add a comment
    explaining why this has to be modified as such.
    
    Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64")
    Signed-off-by: Alexander Duyck <alexanderduyck@xxxxxx>
    Acked-by: Xu Kuohai <xukuohai@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/168926677665.316237.9953845318337455525.stgit@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 8f16217c111c8..14134fd34ff79 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
 	 *
 	 */
 
-	emit_bti(A64_BTI_C, ctx);
+	/* bpf function may be invoked by 3 instruction types:
+	 * 1. bl, attached via freplace to bpf prog via short jump
+	 * 2. br, attached via freplace to bpf prog via long jump
+	 * 3. blr, working as a function pointer, used by emit_call.
+	 * So BTI_JC should used here to support both br and blr.
+	 */
+	emit_bti(A64_BTI_JC, ctx);
 
 	emit(A64_MOV(1, A64_R(9), A64_LR), ctx);
 	emit(A64_NOP, ctx);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux