riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC
authorPu Lehui <pulehui@huawei.com>
Tue, 6 Dec 2022 09:14:10 +0000 (17:14 +0800)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 6 Dec 2022 19:59:27 +0000 (20:59 +0100)
commitb54b6003612a376e7be32cbc5c1af3754bbbbb3d
tree3cb3717d8eddc2998c515cd0630aedc140e95e60
parent08388efe593106d2fcd6ddf7a269db58a62a5dda
riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC

For BPF_PSEUDO_FUNC instruction, verifier will refill imm with
correct addresses of bpf_calls and then run last pass of JIT.
Since the emit_imm of RV64 is variable-length, which will emit
appropriate length instructions accorroding to the imm, it may
broke ctx->offset, and lead to unpredictable problem, such as
inaccurate jump. So let's fix it with fixed-length instructions.

Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Suggested-by: Björn Töpel <bjorn@rivosinc.com>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
Link: https://lore.kernel.org/bpf/20221206091410.1584784-1-pulehui@huaweicloud.com
arch/riscv/net/bpf_jit_comp64.c