linux.git/arch/mips/net, branch v3.16.81

bpf, mips: fix off-by-one in ctx offset allocation

2016-11-20T01:16:56+00:00

commit b4e76f7e6d3200462c6354a6ad4ae167459e61f8 upstream.

Dan Carpenter reported [1] a static checker warning that ctx->offsets[]
may be accessed off by one from build_body(), since it's allocated with
fp->len * sizeof(*ctx.offsets) as length. The cBPF arm and ppc code
doesn't have this issue as claimed, so only mips seems to be affected and
should like most other JITs allocate with fp->len + 1. A few number of
JITs (x86, sparc, arm64) handle this differently, where they only require
fp->len array elements.

  [1] http://www.spinics.net/lists/mips/msg64193.html

Fixes: c6610de353da ("MIPS: net: Add BPF JIT")
Reported-by: Dan Carpenter 
Signed-off-by: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: ast@kernel.org
Cc: linux-mips@linux-mips.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13814/
Signed-off-by: Ralf Baechle 
Signed-off-by: Ben Hutchings

net: filter: make JITs zero A for SKF_AD_ALU_XOR_X

2016-01-25T10:44:05+00:00

commit 55795ef5469290f89f04e12e662ded604909e462 upstream.

The SKF_AD_ALU_XOR_X ancillary is not like the other ancillary data
instructions since it XORs A with X while all the others replace A with
some loaded value.  All the BPF JITs fail to clear A if this is used as
the first instruction in a filter.  This was found using american fuzzy
lop.

Add a helper to determine if A needs to be cleared given the first
instruction in a filter, and use this in the JITs.  Except for ARM, the
rest have only been compile-tested.

Fixes: 3480593131e0 ("net: filter: get rid of BPF_S_* enum")
Signed-off-by: Rabin Vincent 
Acked-by: Daniel Borkmann 
Acked-by: Alexei Starovoitov 
Signed-off-by: David S. Miller 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

mips: bpf: Fix broken BPF_MOD

2014-12-15T11:10:47+00:00

commit 2e46477a12f6fd273e31a220b155d66e8352198c upstream.

Remove optimize_div() from BPF_MOD | BPF_K case
since we don't know the dividend and fix the
emit_mod() by reading the mod operation result from HI register

Signed-off-by: Denis Kirjanov 
Reviewed-by: Markos Chandras 
Signed-off-by: David S. Miller 
Signed-off-by: Luis Henriques

MIPS: bpf: Fix stack space allocation for BPF memwords on MIPS64

2014-06-26T09:48:23+00:00

When allocating stack space for BPF memwords we need to use the
appropriate 32 or 64-bit instruction to avoid losing the top 32 bits
of the stack pointer.

Signed-off-by: Markos Chandras 
Cc: "David S. Miller" 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: netdev@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7135/
Signed-off-by: Ralf Baechle

MIPS: BPF: Use 32 or 64-bit load instruction to load an address to register

2014-06-26T09:48:22+00:00

When loading a pointer to register we need to use the appropriate
32 or 64bit instruction to preserve the pointers' top 32bits.

Signed-off-by: Markos Chandras 
Cc: David S. Miller 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: netdev@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7180/
Signed-off-by: Ralf Baechle

MIPS: bpf: Fix PKT_TYPE case for big-endian cores

2014-06-26T09:48:22+00:00

The skb->pkt_type field is defined as follows:

u8 pkt_type:3,
   fclone:2,
   ipvs_property:1,
   peeked:1,
   nf_trace:1

resulting to the following layout in big-endian systems

[pkt_type][fclone][ipvs_propery][peeked][nf_trace]
^                                                ^
|                                                |
LSB                                             MSB

As a result, the existing code did not work because it was trying to
match pkt_type == 7 whereas in reality it is 7<<5 on big-endian
systems.

This has been fixed in the interpreter in
0dcceabb0c1bf2d4c12a748df9933fad303072a7
"net: filter: fix SKF_AD_PKTTYPE extension on big-endian"

The fix is to look for 7<<5 on big-endian systems for the pkt_type
field, and shift by 5 so the packet type will be at the lower 3 bits
of the A register.

Signed-off-by: Markos Chandras 
Cc: David S. Miller 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: netdev@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7132/
Signed-off-by: Ralf Baechle

MIPS: BPF: Prevent kernel fall over for >=32bit shifts

2014-06-26T09:48:22+00:00

Remove BUG_ON() if the shift immediate is >=32 to avoid kernel crashes
due to malicious user input. If the shift immediate is >= 32,
we simply load the destination register with 0 since only
32-bit instructions are used by JIT so this will do the
correct thing even on MIPS64.

Signed-off-by: Markos Chandras 
Cc: David S. Miller 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: netdev@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7179/
Signed-off-by: Ralf Baechle

MIPS: bpf: Drop update_on_xread and always initialize the X register

2014-06-26T09:48:22+00:00

Previously, update_on_xread() only set the reset flag if SEEN_X hasn't
been set already. However, SEEN_X is used to indicate that X is used
as destination or source register so there are some cases where X
is only used as source register and we really need to make sure that it
has been initialized in time. As a result of which, drop this function and
always set X to zero if it's used in any of the opcodes.

Signed-off-by: Markos Chandras 
Cc: David S. Miller 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: netdev@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7133/
Signed-off-by: Ralf Baechle

MIPS: bpf: Fix is_range() semantics

2014-06-26T09:48:21+00:00

is_range() was meant to check whether the number is within
the s16 range or not. However the return values and consumers expected
the exact opposite. We fix that by inverting the logic in the function
to return 'true' for < s16 and 'false' for > s16.

Signed-off-by: Markos Chandras 
Reported-by: Alexei Starovoitov 
Cc: David S. Miller 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: netdev@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7131/
Signed-off-by: Ralf Baechle

MIPS: bpf: Use pr_debug instead of pr_warn for unhandled opcodes

2014-06-26T09:48:21+00:00

We should prevent spamming the logs during normal execution of bpf-jit.

Signed-off-by: Markos Chandras 
Suggested-by: Alexei Starovoitov 
Cc: David S. Miller 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Cc: netdev@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7129/
Signed-off-by: Ralf Baechle