bpf: fix bpf_tail_call() x64 JIT
authorAlexei Starovoitov <ast@fb.com>
Tue, 3 Oct 2017 22:37:20 +0000 (15:37 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 3 Oct 2017 23:04:44 +0000 (16:04 -0700)
commit90caccdd8cc0215705f18b92771b449b01e2474a
tree8d091b5f97b4c15bf8127a48edd6bc4151374dac
parent05946876f0c16f6fe1db692d575aba42b25f0811
bpf: fix bpf_tail_call() x64 JIT

- bpf prog_array just like all other types of bpf array accepts 32-bit index.
  Clarify that in the comment.
- fix x64 JIT of bpf_tail_call which was incorrectly loading 8 instead of 4 bytes
- tighten corresponding check in the interpreter to stay consistent

The JIT bug can be triggered after introduction of BPF_F_NUMA_NODE flag
in commit 96eabe7a40aa in 4.14. Before that the map_flags would stay zero and
though JIT code is wrong it will check bounds correctly.
Hence two fixes tags. All other JITs don't have this problem.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Fixes: 96eabe7a40aa ("bpf: Allow selecting numa node during map creation")
Fixes: b52f00e6a715 ("x86: bpf_jit: implement bpf_tail_call() helper")
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
arch/x86/net/bpf_jit_comp.c
include/uapi/linux/bpf.h
kernel/bpf/core.c