From 836b2fe544a5e9b5ce116622cb36fba33838c6fd Mon Sep 17 00:00:00 2001 From: Eduard Zingerman Date: Fri, 4 Sep 2026 01:33:23 -0700 Subject: selftests/bpf: Check that JMP32 pointer vs zero jumps are not predicted Add jmp32_ptr_vs_zero_jne: the fall-through of the 32-bit compare, which the verifier used to skip, contains an out of bounds map value access, hence w/o the previous patch the program is accepted. See previous patch for detailed description. Reported-by: Nicholas Carlini Suggested-by: Nicholas Carlini Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20260904083325.2083493-6-eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi --- arch/powerpc/sysdev/dcr-low.S | 44 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 arch/powerpc/sysdev/dcr-low.S (limited to 'arch/powerpc/sysdev/dcr-low.S') diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S new file mode 100644 index 000000000..e8401b205 --- /dev/null +++ b/arch/powerpc/sysdev/dcr-low.S @@ -0,0 +1,44 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * "Indirect" DCR access + * + * Copyright (c) 2004 Eugene Surovegin + */ + +#include +#include +#include +#include + +#define DCR_ACCESS_PROLOG(table) \ + cmplwi cr0,r3,1024; \ + rlwinm r3,r3,4,18,27; \ + lis r5,table@h; \ + ori r5,r5,table@l; \ + add r3,r3,r5; \ + bge- 1f; \ + mtctr r3; \ + bctr; \ +1: trap; \ + EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,0; \ + blr + +_GLOBAL(__mfdcr) + DCR_ACCESS_PROLOG(__mfdcr_table) +EXPORT_SYMBOL(__mfdcr) + +_GLOBAL(__mtdcr) + DCR_ACCESS_PROLOG(__mtdcr_table) +EXPORT_SYMBOL(__mtdcr) + +__mfdcr_table: + mfdcr r3,0; blr +__mtdcr_table: + mtdcr 0,r4; blr + +dcr = 1 + .rept 1023 + mfdcr r3,dcr; blr + mtdcr dcr,r4; blr + dcr = dcr + 1 + .endr -- cgit v1.3.1