mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 09:31:09 +00:00
6edf0aa4f8
In case of usage of skb_vlan_push/pop, in the prologue we store
the SKB pointer on the stack and restore it after BPF_JMP_CALL
to skb_vlan_push/pop.
Unfortunately currently there are two bugs in the code:
1) The wrong stack slot (offset 170 instead of 176) is used
2) The wrong register (W1 instead of B1) is saved
So fix this and use correct stack slot and register.
Fixes: 9db7f2b818 ("s390/bpf: recache skb->data/hlen for skb_vlan_push/pop")
Cc: stable@vger.kernel.org # 4.3+
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
69 lines
2 KiB
C
69 lines
2 KiB
C
/*
|
|
* BPF Jit compiler defines
|
|
*
|
|
* Copyright IBM Corp. 2012,2015
|
|
*
|
|
* Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
|
|
* Michael Holzheu <holzheu@linux.vnet.ibm.com>
|
|
*/
|
|
|
|
#ifndef __ARCH_S390_NET_BPF_JIT_H
|
|
#define __ARCH_S390_NET_BPF_JIT_H
|
|
|
|
#ifndef __ASSEMBLY__
|
|
|
|
#include <linux/filter.h>
|
|
#include <linux/types.h>
|
|
|
|
extern u8 sk_load_word_pos[], sk_load_half_pos[], sk_load_byte_pos[];
|
|
extern u8 sk_load_word[], sk_load_half[], sk_load_byte[];
|
|
|
|
#endif /* __ASSEMBLY__ */
|
|
|
|
/*
|
|
* Stackframe layout (packed stack):
|
|
*
|
|
* ^ high
|
|
* +---------------+ |
|
|
* | old backchain | |
|
|
* +---------------+ |
|
|
* | r15 - r6 | |
|
|
* +---------------+ |
|
|
* | 4 byte align | |
|
|
* | tail_call_cnt | |
|
|
* BFP -> +===============+ |
|
|
* | | |
|
|
* | BPF stack | |
|
|
* | | |
|
|
* +---------------+ |
|
|
* | 8 byte skbp | |
|
|
* R15+176 -> +---------------+ |
|
|
* | 8 byte hlen | |
|
|
* R15+168 -> +---------------+ |
|
|
* | 4 byte align | |
|
|
* +---------------+ |
|
|
* | 4 byte temp | |
|
|
* | for bpf_jit.S | |
|
|
* R15+160 -> +---------------+ |
|
|
* | new backchain | |
|
|
* R15+152 -> +---------------+ |
|
|
* | + 152 byte SA | |
|
|
* R15 -> +---------------+ + low
|
|
*
|
|
* We get 160 bytes stack space from calling function, but only use
|
|
* 12 * 8 byte for old backchain, r15..r6, and tail_call_cnt.
|
|
*/
|
|
#define STK_SPACE (MAX_BPF_STACK + 8 + 8 + 4 + 4 + 160)
|
|
#define STK_160_UNUSED (160 - 12 * 8)
|
|
#define STK_OFF (STK_SPACE - STK_160_UNUSED)
|
|
#define STK_OFF_TMP 160 /* Offset of tmp buffer on stack */
|
|
#define STK_OFF_HLEN 168 /* Offset of SKB header length on stack */
|
|
#define STK_OFF_SKBP 176 /* Offset of SKB pointer on stack */
|
|
|
|
#define STK_OFF_R6 (160 - 11 * 8) /* Offset of r6 on stack */
|
|
#define STK_OFF_TCCNT (160 - 12 * 8) /* Offset of tail_call_cnt on stack */
|
|
|
|
/* Offset to skip condition code check */
|
|
#define OFF_OK 4
|
|
|
|
#endif /* __ARCH_S390_NET_BPF_JIT_H */
|