Patch "bpf, arm64: Fix address emission with tag-based KASAN enabled" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf, arm64: Fix address emission with tag-based KASAN enabled

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-arm64-fix-address-emission-with-tag-based-kasan-.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9f0f83e9aeeccd730f974b11814e03998b22814f
Author: Peter Collingbourne <pcc@xxxxxxxxxx>
Date:   Fri Oct 18 15:16:43 2024 -0700

    bpf, arm64: Fix address emission with tag-based KASAN enabled
    
    [ Upstream commit a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c ]
    
    When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image
    struct on the stack is passed during the size calculation pass and
    an address on the heap is passed during code generation. This may
    cause a heap buffer overflow if the heap address is tagged because
    emit_a64_mov_i64() will emit longer code than it did during the size
    calculation pass. The same problem could occur without tag-based
    KASAN if one of the 16-bit words of the stack address happened to
    be all-ones during the size calculation pass. Fix the problem by
    assuming the worst case (4 instructions) when calculating the size
    of the bpf_tramp_image address emission.
    
    Fixes: 19d3c179a377 ("bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG")
    Signed-off-by: Peter Collingbourne <pcc@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Xu Kuohai <xukuohai@xxxxxxxxxx>
    Link: https://linux-review.googlesource.com/id/I1496f2bc24fba7a1d492e16e2b94cf43714f2d3c
    Link: https://lore.kernel.org/bpf/20241018221644.3240898-1-pcc@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 59e05a7aea56a..6e5a934ee2f55 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -2172,7 +2172,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
 	emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx);
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
-		emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
+		/* for the first pass, assume the worst case */
+		if (!ctx->image)
+			ctx->idx += 4;
+		else
+			emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
 		emit_call((const u64)__bpf_tramp_enter, ctx);
 	}
 
@@ -2216,7 +2220,11 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
 		im->ip_epilogue = ctx->ro_image + ctx->idx;
-		emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
+		/* for the first pass, assume the worst case */
+		if (!ctx->image)
+			ctx->idx += 4;
+		else
+			emit_a64_mov_i64(A64_R(0), (const u64)im, ctx);
 		emit_call((const u64)__bpf_tramp_exit, ctx);
 	}