)]}'
{
  "commit": "03687dad99da4824473608a78a34d1743bde2552",
  "tree": "6788aa3f91ca9a3d8ab470c19dccadcdf160d4d6",
  "parents": [
    "23851459ab405049e5ee00aa54b3c3ef32abad6d"
  ],
  "author": {
    "name": "Piotr Krysiuk",
    "email": "piotras@gmail.com",
    "time": "Mon Apr 05 22:52:15 2021 +0100"
  },
  "committer": {
    "name": "Oleksandr Tymoshenko",
    "email": "ovt@google.com",
    "time": "Fri Apr 16 18:31:11 2021 +0000"
  },
  "message": "bpf, x86: Validate computation of branch displacements for x86-64\n\ncommit e4d4d456436bfb2fe412ee2cd489f7658449b098 upstream.\n\nThe branch displacement logic in the BPF JIT compilers for x86 assumes\nthat, for any generated branch instruction, the distance cannot\nincrease between optimization passes.\n\nBut this assumption can be violated due to how the distances are\ncomputed. Specifically, whenever a backward branch is processed in\ndo_jit(), the distance is computed by subtracting the positions in the\nmachine code from different optimization passes. This is because part\nof addrs[] is already updated for the current optimization pass, before\nthe branch instruction is visited.\n\nAnd so the optimizer can expand blocks of machine code in some cases.\n\nThis can confuse the optimizer logic, where it assumes that a fixed\npoint has been reached for all machine code blocks once the total\nprogram size stops changing. And then the JIT compiler can output\nabnormal machine code containing incorrect branch displacements.\n\nTo mitigate this issue, we assert that a fixed point is reached while\npopulating the output image. This rejects any problematic programs.\nThe issue affects both x86-32 and x86-64. We mitigate separately to\nease backporting.\n\nBUG\u003db/185462758\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dNone\n\ncos-patch: security-high\nSigned-off-by: Piotr Krysiuk \u003cpiotras@gmail.com\u003e\nReviewed-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 5f26f1f838aa960045c712e13dbab8ff451fed74)\nChange-Id: Iff48ebdb19ceadc87d00cae6267339e1bb9cd9b8\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/15615\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "46ab928312517d528b0c52dbed70138941a2e8a7",
      "old_mode": 33188,
      "old_path": "arch/x86/net/bpf_jit_comp.c",
      "new_id": "924ca27a6139b7d3e4246c9afb8fce5e8f4987e3",
      "new_mode": 33188,
      "new_path": "arch/x86/net/bpf_jit_comp.c"
    }
  ]
}