On Mon, Feb 26, 2018 at 10:00:47PM +0100, Daniel Borkmann wrote:
> While working on 16338a9b3ac3 ("bpf, arm64: fix out of bounds access in
> tail call") I noticed that ppc64 JIT is partially affected as well. While
> the bound checking is correctly performed as unsigned comparison, the
> register with the index value however, is never truncated into 32 bit
> space, so e.g. a index value of 0x100000000ULL with a map of 1 element
> would pass with PPC_CMPLW() whereas we later on continue with the full
> 64 bit register value. Therefore, as we do in interpreter and other JITs
> truncate the value to 32 bit initially in order to fix access.
>
> Fixes: ce0761419fae ("powerpc/bpf: Implement support for tail calls")
> Signed-off-by: Daniel Borkmann <dan...@iogearbox.net>
> Reviewed-by: Naveen N. Rao <naveen.n....@linux.vnet.ibm.com>
> Tested-by: Naveen N. Rao <naveen.n....@linux.vnet.ibm.com>
Applied to bpf tree, thanks Daniel.
