[PATCH] x86 bpf: Fix extable offset calculation

commit 4c5de127598e1 ("bpf: Emit explicit NULL pointer checks
for PROBE_LDX instructions.") is emitting couple of instructions
before actual load. Consider those additional instructions while
calculating extable offset.

Fixes: 4c5de127598e1 ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.")
Signed-off-by: Ravi Bangoria <redacted>
---
 arch/x86/net/bpf_jit_comp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 2a2e290fa5d8..231a8178cc11 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c

@@ -1297,7 +1297,7 @@ st:			if (is_imm8(insn->off))
 			emit_ldx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn->off);
 			if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
 				struct exception_table_entry *ex;
-				u8 *_insn = image + proglen;
+				u8 *_insn = image + proglen + (u8)(start_of_ldx - temp);
 				s64 delta;
 
 				/* populate jmp_offset for JMP above */

-- 
2.30.2

On Tue, Jun 22, 2021 at 4:01 AM Ravi Bangoria
[off-list ref] wrote:

Great debugging and the fix. Thanks a lot.
I've dropped (u8) cast, kept (), and applied to bpf tree.
I think it looks cleaner without that cast.
Could you send a followup patch with a selftest, so I don't make
the same mistake again ? ;)

On 6/25/21 9:31 AM, Alexei Starovoitov wrote:

On Tue, Jun 22, 2021 at 4:01 AM Ravi Bangoria
[off-list ref] wrote:

quoted

commit 4c5de127598e1 ("bpf: Emit explicit NULL pointer checks
for PROBE_LDX instructions.") is emitting couple of instructions
before actual load. Consider those additional instructions while
calculating extable offset.

Fixes: 4c5de127598e1 ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.")
Signed-off-by: Ravi Bangoria <redacted>
---
  arch/x86/net/bpf_jit_comp.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 2a2e290fa5d8..231a8178cc11 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c

@@ -1297,7 +1297,7 @@ st:                       if (is_imm8(insn->off))
                         emit_ldx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn->off);
                         if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
                                 struct exception_table_entry *ex;
-                               u8 *_insn = image + proglen;
+                               u8 *_insn = image + proglen + (u8)(start_of_ldx - temp);

Great debugging and the fix. Thanks a lot.
I've dropped (u8) cast, kept (), and applied to bpf tree.
I think it looks cleaner without that cast.

Thanks.

Could you send a followup patch with a selftest, so I don't make
the same mistake again ? ;)

Unfortunately extable gets involved only for bad kernel pointers and
ideally there should not be any bad pointer in kernel. So there is no
easy way to create a proper selftest for this.

Ravi

On Thu, Jun 24, 2021 at 11:22 PM Ravi Bangoria
[off-list ref] wrote:

quoted

Could you send a followup patch with a selftest, so I don't make
the same mistake again ? ;)

Unfortunately extable gets involved only for bad kernel pointers and
ideally there should not be any bad pointer in kernel. So there is no
easy way to create a proper selftest for this.

Right. We have lib/test_bpf.c kernel module for such cases.