github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 22:14:04 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
0a5bd0ffe7
linux/arch
History
Pu Lehui 1732ebc4a2 riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops 
We encountered a kernel crash triggered by the bpf_tcp_ca testcase as
show below:

Unable to handle kernel paging request at virtual address ff60000088554500
Oops [#1]
...
CPU: 3 PID: 458 Comm: test_progs Tainted: G           OE      6.8.0-rc1-kselftest_plain #1
Hardware name: riscv-virtio,qemu (DT)
epc : 0xff60000088554500
 ra : tcp_ack+0x288/0x1232
epc : ff60000088554500 ra : ffffffff80cc7166 sp : ff2000000117ba50
 gp : ffffffff82587b60 tp : ff60000087be0040 t0 : ff60000088554500
 t1 : ffffffff801ed24e t2 : 0000000000000000 s0 : ff2000000117bbc0
 s1 : 0000000000000500 a0 : ff20000000691000 a1 : 0000000000000018
 a2 : 0000000000000001 a3 : ff60000087be03a0 a4 : 0000000000000000
 a5 : 0000000000000000 a6 : 0000000000000021 a7 : ffffffff8263f880
 s2 : 000000004ac3c13b s3 : 000000004ac3c13a s4 : 0000000000008200
 s5 : 0000000000000001 s6 : 0000000000000104 s7 : ff2000000117bb00
 s8 : ff600000885544c0 s9 : 0000000000000000 s10: ff60000086ff0b80
 s11: 000055557983a9c0 t3 : 0000000000000000 t4 : 000000000000ffc4
 t5 : ffffffff8154f170 t6 : 0000000000000030
status: 0000000200000120 badaddr: ff60000088554500 cause: 000000000000000c
Code: c796 67d7 0000 0000 0052 0002 c13b 4ac3 0000 0000 (0001) 0000
---[ end trace 0000000000000000 ]---

The reason is that commit 2cd3e3772e ("x86/cfi,bpf: Fix bpf_struct_ops
CFI") changes the func_addr of arch_prepare_bpf_trampoline in struct_ops
from NULL to non-NULL, while we use func_addr on RV64 to differentiate
between struct_ops and regular trampoline. When the struct_ops testcase
is triggered, it emits wrong prologue and epilogue, and lead to
unpredictable issues. After commit 2cd3e3772e, we can use
BPF_TRAMP_F_INDIRECT to distinguish them as it always be set in
struct_ops.

Fixes: 2cd3e3772e ("x86/cfi,bpf: Fix bpf_struct_ops CFI")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Björn Töpel <bjorn@rivosinc.com>
Acked-by: Björn Töpel <bjorn@kernel.org>
Link: https://lore.kernel.org/bpf/20240123023207.1917284-1-pulehui@huaweicloud.com
2024-01-23 23:21:38 +01:00
..
alpha RTC for 6.8 2024-01-18 17:25:39 -08:00
arc IOMMU Updates for Linux v6.8 2024-01-18 15:16:57 -08:00
arm IOMMU Updates for Linux v6.8 2024-01-18 15:16:57 -08:00
arm64 IOMMU Updates for Linux v6.8 2024-01-18 15:16:57 -08:00
csky percpu: 2024-01-18 15:01:28 -08:00
hexagon asm-generic cleanups for 6.8 2024-01-10 18:13:44 -08:00
loongarch Driver core changes for 6.8-rc1 2024-01-18 09:48:40 -08:00
m68k percpu: 2024-01-18 15:01:28 -08:00
microblaze Microblaze patches for 6.8-rc1 2024-01-17 11:27:23 -08:00
mips IOMMU Updates for Linux v6.8 2024-01-18 15:16:57 -08:00
nios2 percpu: 2024-01-18 15:01:28 -08:00
openrisc OpenRISC updates for 6.6 2023-09-05 10:09:31 -07:00
parisc percpu: 2024-01-18 15:01:28 -08:00
powerpc TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
riscv riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops 2024-01-23 23:21:38 +01:00
s390 s390 updates for 6.8 merge window part 2 2024-01-18 14:11:25 -08:00
sh percpu: 2024-01-18 15:01:28 -08:00
sparc percpu: 2024-01-18 15:01:28 -08:00
um TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
x86 RTC for 6.8 2024-01-18 17:25:39 -08:00
xtensa percpu: 2024-01-18 15:01:28 -08:00
.gitignore
Kconfig IOMMU Updates for Linux v6.8 2024-01-18 15:16:57 -08:00