Skip to content

Commit 95785d3

Browse files
chenhengqiKernel Patches Daemon
chenhengqi
authored and
Kernel Patches Daemon
committed
LoongArch: BPF: Sign extend struct ops return values properly
The ns_bpf_qdisc selftest triggers a kernel panic: [ 2738.595309] CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58, era == 90000000851b5ac0, ra == 90000000851b5aa4 [ 2738.596716] Oops[#1]: [ 2738.596980] CPU: 0 UID: 0 PID: 449 Comm: test_progs Tainted: G OE 6.16.0+ #3 PREEMPT(full) [ 2738.597184] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 2738.597265] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 [ 2738.597386] pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600 [ 2738.597484] a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008 [ 2738.597577] a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000 [ 2738.597682] t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001 [ 2738.597835] t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d [ 2738.597997] t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800 [ 2738.598097] s1 0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc880 [ 2738.598196] s5 90000001075bc8f0 s6 0000000000000000 s7 0000000000741ce8 s8 0000000000000000 [ 2738.598313] ra: 90000000851b5aa4 __qdisc_run+0xac/0x8d8 [ 2738.598553] ERA: 90000000851b5ac0 __qdisc_run+0xc8/0x8d8 [ 2738.598629] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 2738.598991] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 2738.599065] EUEN: 00000007 (+FPE +SXE +ASXE -BTE) [ 2738.599160] ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) [ 2738.599278] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 2738.599364] BADV: 0000000000741d58 [ 2738.599429] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 2738.599513] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)] [ 2738.599724] Process test_progs (pid: 449, threadinfo=000000009af02b3a, task=00000000e9ba4956) [ 2738.599916] Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8 [ 2738.600065] 90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000 [ 2738.600170] 900000010597c400 900000008694a000 0000000000000000 9000000105b59000 [ 2738.600278] 90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c [ 2738.600381] 9000000086936000 0000000100094d4c fffffff400676208 0000000000000000 [ 2738.600482] 9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000 [ 2738.600585] 9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000 [ 2738.600690] 9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840 [ 2738.600795] 0000000000000000 9000000086be6c40 0000000000000000 0000000000000000 [ 2738.600901] 0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4 [ 2738.601007] ... [ 2738.601062] Call Trace: [ 2738.601135] [<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8 [ 2738.601396] [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0 [ 2738.601482] [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950 [ 2738.601568] [<9000000085374bc8>] ip6_finish_output+0x2b8/0x448 [ 2738.601646] [<9000000085370b24>] ip6_xmit+0x304/0x858 [ 2738.601711] [<90000000853c4438>] inet6_csk_xmit+0x100/0x170 [ 2738.601784] [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0 [ 2738.601863] [<90000000852b47fc>] tcp_connect+0xbcc/0x1168 [ 2738.601934] [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0 [ 2738.602019] [<90000000852e7738>] __inet_stream_connect+0x170/0x480 [ 2738.602103] [<90000000852e7a98>] inet_stream_connect+0x50/0x88 [ 2738.602175] [<90000000850f2814>] __sys_connect+0xe4/0x110 [ 2738.602244] [<90000000850f2858>] sys_connect+0x18/0x28 [ 2738.602320] [<9000000085520c94>] do_syscall+0x94/0x1a0 [ 2738.602399] [<9000000083df1fb8>] handle_syscall+0xb8/0x158 [ 2738.602502] [ 2738.602546] Code: 4001ad80 2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d [ 2738.602724] [ 2738.602916] ---[ end trace 0000000000000000 ]--- [ 2738.603210] Kernel panic - not syncing: Fatal exception in interrupt [ 2738.603548] Kernel relocated by 0x83bb0000 [ 2738.603622] .text @ 0x9000000083db0000 [ 2738.603699] .data @ 0x9000000085690000 [ 2738.603753] .bss @ 0x9000000087491e00 [ 2738.603900] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires LoongArch ABI. So let's sign extend struct ops return values according to the return value spec in function model. Fixes: 6abf17d ("LoongArch: BPF: Add struct ops support for trampoline") Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com> Tested-by: Vincent Li <vincent.mc.li@gmail.com>
1 parent d07b74e commit 95785d3

File tree

1 file changed

+40
-7
lines changed

1 file changed

+40
-7
lines changed

‎arch/loongarch/net/bpf_jit.c

Lines changed: 40 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1361,7 +1361,8 @@ static void restore_args(struct jit_ctx *ctx, int nargs, int args_off)
13611361
}
13621362

13631363
static int invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_link *l,
1364-
int args_off, int retval_off, int run_ctx_off, bool save_ret)
1364+
const struct btf_func_model *m, int args_off,
1365+
int retval_off, int run_ctx_off, bool save_ret)
13651366
{
13661367
int ret;
13671368
u32 *branch;
@@ -1425,13 +1426,14 @@ static int invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_link *l,
14251426
}
14261427

14271428
static void invoke_bpf_mod_ret(struct jit_ctx *ctx, struct bpf_tramp_links *tl,
1428-
int args_off, int retval_off, int run_ctx_off, u32 **branches)
1429+
const struct btf_func_model *m, int args_off,
1430+
int retval_off, int run_ctx_off, u32 **branches)
14291431
{
14301432
int i;
14311433

14321434
emit_insn(ctx, std, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_FP, -retval_off);
14331435
for (i = 0; i < tl->nr_links; i++) {
1434-
invoke_bpf_prog(ctx, tl->links[i], args_off, retval_off, run_ctx_off, true);
1436+
invoke_bpf_prog(ctx, tl->links[i], m, args_off, retval_off, run_ctx_off, true);
14351437
emit_insn(ctx, ldd, LOONGARCH_GPR_T1, LOONGARCH_GPR_FP, -retval_off);
14361438
branches[i] = (u32 *)ctx->image + ctx->idx;
14371439
emit_insn(ctx, nop);
@@ -1448,6 +1450,30 @@ void arch_free_bpf_trampoline(void *image, unsigned int size)
14481450
bpf_prog_pack_free(image, size);
14491451
}
14501452

1453+
/*
1454+
* Sign-extend the register if necessary
1455+
*/
1456+
static int sign_extend(struct jit_ctx *ctx, int r, u8 size)
1457+
{
1458+
switch (size) {
1459+
case 1:
1460+
emit_insn(ctx, sllid, r, r, 56);
1461+
emit_insn(ctx, sraid, r, r, 56);
1462+
return 0;
1463+
case 2:
1464+
emit_insn(ctx, sllid, r, r, 48);
1465+
emit_insn(ctx, sraid, r, r, 48);
1466+
return 0;
1467+
case 4:
1468+
emit_insn(ctx, addiw, r, r, 0);
1469+
return 0;
1470+
case 8:
1471+
return 0;
1472+
default:
1473+
return -1;
1474+
}
1475+
}
1476+
14511477
static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
14521478
const struct btf_func_model *m, struct bpf_tramp_links *tlinks,
14531479
void *func_addr, u32 flags)
@@ -1602,8 +1628,8 @@ static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_i
16021628
}
16031629

16041630
for (i = 0; i < fentry->nr_links; i++) {
1605-
ret = invoke_bpf_prog(ctx, fentry->links[i], args_off, retval_off,
1606-
run_ctx_off, flags & BPF_TRAMP_F_RET_FENTRY_RET);
1631+
ret = invoke_bpf_prog(ctx, fentry->links[i], m, args_off, retval_off,
1632+
run_ctx_off, flags & BPF_TRAMP_F_RET_FENTRY_RET);
16071633
if (ret)
16081634
return ret;
16091635
}
@@ -1612,7 +1638,7 @@ static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_i
16121638
if (!branches)
16131639
return -ENOMEM;
16141640

1615-
invoke_bpf_mod_ret(ctx, fmod_ret, args_off, retval_off, run_ctx_off, branches);
1641+
invoke_bpf_mod_ret(ctx, fmod_ret, m, args_off, retval_off, run_ctx_off, branches);
16161642
}
16171643

16181644
if (flags & BPF_TRAMP_F_CALL_ORIG) {
@@ -1638,7 +1664,8 @@ static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_i
16381664
}
16391665

16401666
for (i = 0; i < fexit->nr_links; i++) {
1641-
ret = invoke_bpf_prog(ctx, fexit->links[i], args_off, retval_off, run_ctx_off, false);
1667+
ret = invoke_bpf_prog(ctx, fexit->links[i], m, args_off,
1668+
retval_off, run_ctx_off, false);
16421669
if (ret)
16431670
goto out;
16441671
}
@@ -1657,6 +1684,12 @@ static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_i
16571684
if (save_ret) {
16581685
emit_insn(ctx, ldd, LOONGARCH_GPR_A0, LOONGARCH_GPR_FP, -retval_off);
16591686
emit_insn(ctx, ldd, regmap[BPF_REG_0], LOONGARCH_GPR_FP, -(retval_off - 8));
1687+
if (is_struct_ops) {
1688+
move_reg(ctx, LOONGARCH_GPR_A0, regmap[BPF_REG_0]);
1689+
ret = sign_extend(ctx, LOONGARCH_GPR_A0, m->ret_size);
1690+
if (ret)
1691+
goto out;
1692+
}
16601693
}
16611694

16621695
emit_insn(ctx, ldd, LOONGARCH_GPR_S1, LOONGARCH_GPR_FP, -sreg_off);

0 commit comments

Comments
 (0)