From: Greg Kroah-Hartman Date: Fri, 1 May 2020 06:53:34 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.4.37~14 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6509a6f43e170307f844aad1625ac37fb98ab658;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: bpf-x86_32-fix-clobbering-of-dst-for-bpf_jset.patch --- diff --git a/queue-4.19/bpf-x86_32-fix-clobbering-of-dst-for-bpf_jset.patch b/queue-4.19/bpf-x86_32-fix-clobbering-of-dst-for-bpf_jset.patch new file mode 100644 index 00000000000..cdb0573bcb1 --- /dev/null +++ b/queue-4.19/bpf-x86_32-fix-clobbering-of-dst-for-bpf_jset.patch @@ -0,0 +1,85 @@ +From 50fe7ebb6475711c15b3397467e6424e20026d94 Mon Sep 17 00:00:00 2001 +From: Luke Nelson +Date: Wed, 22 Apr 2020 10:36:30 -0700 +Subject: bpf, x86_32: Fix clobbering of dst for BPF_JSET + +From: Luke Nelson + +commit 50fe7ebb6475711c15b3397467e6424e20026d94 upstream. + +The current JIT clobbers the destination register for BPF_JSET BPF_X +and BPF_K by using "and" and "or" instructions. This is fine when the +destination register is a temporary loaded from a register stored on +the stack but not otherwise. + +This patch fixes the problem (for both BPF_K and BPF_X) by always loading +the destination register into temporaries since BPF_JSET should not +modify the destination register. + +This bug may not be currently triggerable as BPF_REG_AX is the only +register not stored on the stack and the verifier uses it in a limited +way. + +Fixes: 03f5781be2c7b ("bpf, x86_32: add eBPF JIT compiler for ia32") +Signed-off-by: Xi Wang +Signed-off-by: Luke Nelson +Signed-off-by: Alexei Starovoitov +Acked-by: Wang YanQing +Link: https://lore.kernel.org/bpf/20200422173630.8351-2-luke.r.nels@gmail.com +Signed-off-by: Wang YanQing +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/net/bpf_jit_comp32.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/arch/x86/net/bpf_jit_comp32.c ++++ b/arch/x86/net/bpf_jit_comp32.c +@@ -1970,8 +1970,8 @@ static int do_jit(struct bpf_prog *bpf_p + goto emit_cond_jmp_signed; + } + case BPF_JMP | BPF_JSET | BPF_X: { +- u8 dreg_lo = dstk ? IA32_EAX : dst_lo; +- u8 dreg_hi = dstk ? IA32_EDX : dst_hi; ++ u8 dreg_lo = IA32_EAX; ++ u8 dreg_hi = IA32_EDX; + u8 sreg_lo = sstk ? IA32_ECX : src_lo; + u8 sreg_hi = sstk ? IA32_EBX : src_hi; + +@@ -1980,6 +1980,12 @@ static int do_jit(struct bpf_prog *bpf_p + STACK_VAR(dst_lo)); + EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EDX), + STACK_VAR(dst_hi)); ++ } else { ++ /* mov dreg_lo,dst_lo */ ++ EMIT2(0x89, add_2reg(0xC0, dreg_lo, dst_lo)); ++ /* mov dreg_hi,dst_hi */ ++ EMIT2(0x89, ++ add_2reg(0xC0, dreg_hi, dst_hi)); + } + + if (sstk) { +@@ -1998,8 +2004,8 @@ static int do_jit(struct bpf_prog *bpf_p + } + case BPF_JMP | BPF_JSET | BPF_K: { + u32 hi; +- u8 dreg_lo = dstk ? IA32_EAX : dst_lo; +- u8 dreg_hi = dstk ? IA32_EDX : dst_hi; ++ u8 dreg_lo = IA32_EAX; ++ u8 dreg_hi = IA32_EDX; + u8 sreg_lo = IA32_ECX; + u8 sreg_hi = IA32_EBX; + +@@ -2008,6 +2014,12 @@ static int do_jit(struct bpf_prog *bpf_p + STACK_VAR(dst_lo)); + EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EDX), + STACK_VAR(dst_hi)); ++ } else { ++ /* mov dreg_lo,dst_lo */ ++ EMIT2(0x89, add_2reg(0xC0, dreg_lo, dst_lo)); ++ /* mov dreg_hi,dst_hi */ ++ EMIT2(0x89, ++ add_2reg(0xC0, dreg_hi, dst_hi)); + } + hi = imm32 & (1<<31) ? (u32)~0 : 0; + diff --git a/queue-4.19/hwmon-jc42-fix-name-to-have-no-illegal-characters.patch b/queue-4.19/hwmon-jc42-fix-name-to-have-no-illegal-characters.patch index 482e924f6ef..140d186fddf 100644 --- a/queue-4.19/hwmon-jc42-fix-name-to-have-no-illegal-characters.patch +++ b/queue-4.19/hwmon-jc42-fix-name-to-have-no-illegal-characters.patch @@ -22,14 +22,12 @@ Link: https://lore.kernel.org/r/20200417092853.31206-1-s.hauer@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin --- - drivers/hwmon/jc42.c | 2 +- + drivers/hwmon/jc42.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c -index e5234f953a6d1..b6e5aaa54963d 100644 --- a/drivers/hwmon/jc42.c +++ b/drivers/hwmon/jc42.c -@@ -527,7 +527,7 @@ static int jc42_probe(struct i2c_client *client, const struct i2c_device_id *id) +@@ -527,7 +527,7 @@ static int jc42_probe(struct i2c_client } data->config = config; @@ -38,6 +36,3 @@ index e5234f953a6d1..b6e5aaa54963d 100644 data, &jc42_chip_info, NULL); return PTR_ERR_OR_ZERO(hwmon_dev); --- -2.20.1 - diff --git a/queue-4.19/series b/queue-4.19/series index 977afe093e3..e4623111f36 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -41,3 +41,4 @@ ext4-use-matching-invalidatepage-in-ext4_writepage.patch ext4-increase-wait-time-needed-before-reuse-of-delet.patch ext4-convert-bug_on-s-to-warn_on-s-in-mballoc.c.patch hwmon-jc42-fix-name-to-have-no-illegal-characters.patch +bpf-x86_32-fix-clobbering-of-dst-for-bpf_jset.patch