Daniel Borkmann 87f947e2bb bpf: Fix clobbering of r2 in bpf_gen_ld_abs ... [ Upstream commit e6a18d36118bea3bf497c9df4d9988b6df120689 ] Bryce reported that he saw the following with: 0: r6 = r1 1: r1 = 12 2: r0 = *(u16 *)skb[r1] The xlated sequence was incorrectly clobbering r2 with pointer value of r6 ... 0: (bf) r6 = r1 1: (b7) r1 = 12 2: (bf) r1 = r6 3: (bf) r2 = r1 4: (85) call bpf_skb_load_helper_16_no_cache#7692160 ... and hence call to the load helper never succeeded given the offset was too high. Fix it by reordering the load of r6 to r1. Other than that the insn has similar calling convention than BPF helpers, that is, r0 - r5 are scratch regs, so nothing else affected after the insn. Fixes: e0cea7ce98 ("bpf: implement ld_abs/ld_ind in native bpf") Reported-by: Bryce Kahle <bryce.kahle@datadoghq.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/cace836e4d07bb63b1a53e49c5dfb238a040c298.1599512096.git.daniel@iogearbox.net Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-10-01 13:14:52 +02:00
..
datagram.c
dev.c
dev_addr_lists.c
dev_ioctl.c
devlink.c
drop_monitor.c
dst.c
dst_cache.c
ethtool.c
failover.c
fib_notifier.c
fib_rules.c
filter.c	bpf: Fix clobbering of r2 in bpf_gen_ld_abs	2020-10-01 13:14:52 +02:00
flow_dissector.c
gen_estimator.c
gen_stats.c
gro_cells.c
hwbm.c
link_watch.c
lwt_bpf.c
lwtunnel.c
Makefile
neighbour.c
net-procfs.c
net-sysfs.c
net-sysfs.h
net-traces.c
net_namespace.c
netclassid_cgroup.c
netevent.c
netpoll.c
netprio_cgroup.c
page_pool.c
pktgen.c
ptp_classifier.c
request_sock.c
rtnetlink.c
scm.c
secure_seq.c
skbuff.c
sock.c
sock_diag.c
sock_reuseport.c
stream.c
sysctl_net_core.c
timestamping.c
tso.c
utils.c
xdp.c