bpf: move tmp variable into ax register in interpreter

commit 144cd91c4c2bced6eb8a7e25e590f6618a11e854 upstream.

This change moves the on-stack 64 bit tmp variable in ___bpf_prog_run()
into the hidden ax register. The latter is currently only used in JITs
for constant blinding as a temporary scratch register, meaning the BPF
interpreter will never see the use of ax. Therefore it is safe to use
it for the cases where tmp has been used earlier. This is needed to later
on allow restricted hidden use of ax in both interpreter and JITs.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[backported to 4.14 sblbir]
Signed-off-by: Balbir Singh <sblbir@amzn.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 56d2cda9931b51187c4ce2b6f79b21d545bbfa87..f7880c7163082911015cc19f8b39335043c39aa7 100644 (file)
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -53,7 +53,8 @@ struct bpf_prog_aux;
  * constants. See JIT pre-step in bpf_jit_blind_constants().
  */
 #define BPF_REG_AX             MAX_BPF_REG
-#define MAX_BPF_JIT_REG                (MAX_BPF_REG + 1)
+#define MAX_BPF_EXT_REG                (MAX_BPF_REG + 1)
+#define MAX_BPF_JIT_REG                MAX_BPF_EXT_REG
 
 /* unused opcode to mark special call to bpf_tail_call() helper */
 #define BPF_TAIL_CALL  0xf0

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d203a5d6b726d6bb80cb7162b0a6e7c534ef67df..e59a72c7d092fa04747963dcc246d4d010da88bf 100644 (file)
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -51,6 +51,7 @@
 #define DST    regs[insn->dst_reg]
 #define SRC    regs[insn->src_reg]
 #define FP     regs[BPF_REG_FP]
+#define AX     regs[BPF_REG_AX]
 #define ARG1   regs[BPF_REG_ARG1]
 #define CTX    regs[BPF_REG_CTX]
 #define IMM    insn->imm
@@ -939,22 +940,22 @@ select_insn:
        ALU64_MOD_X:
                if (unlikely(SRC == 0))
                        return 0;
-               div64_u64_rem(DST, SRC, &tmp);
-               DST = tmp;
+               div64_u64_rem(DST, SRC, &AX);
+               DST = AX;
                CONT;
        ALU_MOD_X:
                if (unlikely((u32)SRC == 0))
                        return 0;
-               tmp = (u32) DST;
-               DST = do_div(tmp, (u32) SRC);
+               AX = (u32) DST;
+               DST = do_div(AX, (u32) SRC);
                CONT;
        ALU64_MOD_K:
-               div64_u64_rem(DST, IMM, &tmp);
-               DST = tmp;
+               div64_u64_rem(DST, IMM, &AX);
+               DST = AX;
                CONT;
        ALU_MOD_K:
-               tmp = (u32) DST;
-               DST = do_div(tmp, (u32) IMM);
+               AX = (u32) DST;
+               DST = do_div(AX, (u32) IMM);
                CONT;
        ALU64_DIV_X:
                if (unlikely(SRC == 0))
@@ -964,17 +965,17 @@ select_insn:
        ALU_DIV_X:
                if (unlikely((u32)SRC == 0))
                        return 0;
-               tmp = (u32) DST;
-               do_div(tmp, (u32) SRC);
-               DST = (u32) tmp;
+               AX = (u32) DST;
+               do_div(AX, (u32) SRC);
+               DST = (u32) AX;
                CONT;
        ALU64_DIV_K:
                DST = div64_u64(DST, IMM);
                CONT;
        ALU_DIV_K:
-               tmp = (u32) DST;
-               do_div(tmp, (u32) IMM);
-               DST = (u32) tmp;
+               AX = (u32) DST;
+               do_div(AX, (u32) IMM);
+               DST = (u32) AX;
                CONT;
        ALU_END_TO_BE:
                switch (IMM) {
@@ -1278,7 +1279,7 @@ STACK_FRAME_NON_STANDARD(___bpf_prog_run); /* jump table */
 static unsigned int PROG_NAME(stack_size)(const void *ctx, const struct bpf_insn *insn) \
 { \
        u64 stack[stack_size / sizeof(u64)]; \
-       u64 regs[MAX_BPF_REG]; \
+       u64 regs[MAX_BPF_EXT_REG]; \
 \
        FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \
        ARG1 = (u64) (unsigned long) ctx; \