/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com * * This program is free software; you can redistribute it and/or * modify it under the terms of version 2 of the GNU General Public * License as published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. */#include <linux/bpf.h>#include <linux/syscalls.h>#include <linux/slab.h>#include <linux/anon_inodes.h>#include <linux/file.h>#include <linux/license.h>#include <linux/filter.h>#include <linux/version.h> int sysctl_unprivileged_bpf_disabled __read_mostly; static LIST_HEAD(bpf_map_types); static struct bpf_map *find_and_alloc_map(union bpf_attr *attr){ struct bpf_map_type_list *tl; struct bpf_map *map; list_for_each_entry(tl, &bpf_map_types, list_node) { if (tl->type == attr->map_type) { map = tl->ops->map_alloc(attr); if (IS_ERR(map)) return map; map->ops = tl->ops; map->map_type = attr->map_type; return map; } } return ERR_PTR(-EINVAL);} /* boot time registration of different map implementations */void bpf_register_map_type(struct bpf_map_type_list *tl){ list_add(&tl->list_node, &bpf_map_types);} static int bpf_map_charge_memlock(struct bpf_map *map){ struct user_struct *user = get_current_user(); unsigned long memlock_limit; memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; atomic_long_add(map->pages, &user->locked_vm); if (atomic_long_read(&user->locked_vm) > memlock_limit) { atomic_long_sub(map->pages, &user->locked_vm); free_uid(user); return -EPERM; } map->user = user; return 0;} static void bpf_map_uncharge_memlock(struct bpf_map *map){ struct user_struct *user = map->user; atomic_long_sub(map->pages, &user->locked_vm); free_uid(user);} /* called from workqueue */static void bpf_map_free_deferred(struct work_struct *work){ struct bpf_map *map = container_of(work, struct bpf_map, work); bpf_map_uncharge_memlock(map); /* implementation dependent freeing */ map->ops->map_free(map);} static void bpf_map_put_uref(struct bpf_map *map){ if (atomic_dec_and_test(&map->usercnt)) { if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY) bpf_fd_array_map_clear(map); }} /* decrement map refcnt and schedule it for freeing via workqueue * (unrelying map implementation ops->map_free() might sleep) */void bpf_map_put(struct bpf_map *map){ if (atomic_dec_and_test(&map->refcnt)) { INIT_WORK(&map->work, bpf_map_free_deferred); schedule_work(&map->work); }} void bpf_map_put_with_uref(struct bpf_map *map){ bpf_map_put_uref(map); bpf_map_put(map);} static int bpf_map_release(struct inode *inode, struct file *filp){ bpf_map_put_with_uref(filp->private_data); return 0;} static const struct file_operations bpf_map_fops = { .release = bpf_map_release,}; int bpf_map_new_fd(struct bpf_map *map){ return anon_inode_getfd("bpf-map", &bpf_map_fops, map, O_RDWR | O_CLOEXEC);} /* helper macro to check that unused fields 'union bpf_attr' are zero */#define CHECK_ATTR(CMD) \ memchr_inv((void *) &attr->CMD##_LAST_FIELD + \ sizeof(attr->CMD##_LAST_FIELD), 0, \ sizeof(*attr) - \ offsetof(union bpf_attr, CMD##_LAST_FIELD) - \ sizeof(attr->CMD##_LAST_FIELD)) != NULL #define BPF_MAP_CREATE_LAST_FIELD max_entries/* called via syscall */static int map_create(union bpf_attr *attr){ struct bpf_map *map; int err; err = CHECK_ATTR(BPF_MAP_CREATE); if (err) return -EINVAL; /* find map type and init map: hashtable vs rbtree vs bloom vs ... */ map = find_and_alloc_map(attr); if (IS_ERR(map)) return PTR_ERR(map); atomic_set(&map->refcnt, 1); atomic_set(&map->usercnt, 1); err = bpf_map_charge_memlock(map); if (err) goto free_map; err = bpf_map_new_fd(map); if (err < 0) /* failed to allocate fd */ goto free_map; return err; free_map: map->ops->map_free(map); return err;} /* if error is returned, fd is released. * On success caller should complete fd access with matching fdput() */struct bpf_map *__bpf_map_get(struct fd f){ if (!f.file) return ERR_PTR(-EBADF); if (f.file->f_op != &bpf_map_fops) { fdput(f); return ERR_PTR(-EINVAL); } return f.file->private_data;} void bpf_map_inc(struct bpf_map *map, bool uref){ atomic_inc(&map->refcnt); if (uref) atomic_inc(&map->usercnt);} struct bpf_map *bpf_map_get_with_uref(u32 ufd){ struct fd f = fdget(ufd); struct bpf_map *map; map = __bpf_map_get(f); if (IS_ERR(map)) return map; bpf_map_inc(map, true); fdput(f); return map;} /* helper to convert user pointers passed inside __aligned_u64 fields */static void __user *u64_to_ptr(__u64 val){ return (void __user *) (unsigned long) val;} /* last field in 'union bpf_attr' used by this command */#define BPF_MAP_LOOKUP_ELEM_LAST_FIELD value static int map_lookup_elem(union bpf_attr *attr){ void __user *ukey = u64_to_ptr(attr->key); void __user *uvalue = u64_to_ptr(attr->value); int ufd = attr->map_fd; struct bpf_map *map; void *key, *value, *ptr; struct fd f; int err; if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; err = -ENOMEM; value = kmalloc(map->value_size, GFP_USER | __GFP_NOWARN); if (!value) goto free_key; rcu_read_lock(); ptr = map->ops->map_lookup_elem(map, key); if (ptr) memcpy(value, ptr, map->value_size); rcu_read_unlock(); err = -ENOENT; if (!ptr) goto free_value; err = -EFAULT; if (copy_to_user(uvalue, value, map->value_size) != 0) goto free_value; err = 0; free_value: kfree(value);free_key: kfree(key);err_put: fdput(f); return err;} #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags static int map_update_elem(union bpf_attr *attr){ void __user *ukey = u64_to_ptr(attr->key); void __user *uvalue = u64_to_ptr(attr->value); int ufd = attr->map_fd; struct bpf_map *map; void *key, *value; struct fd f; int err; if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; err = -ENOMEM; value = kmalloc(map->value_size, GFP_USER | __GFP_NOWARN); if (!value) goto free_key; err = -EFAULT; if (copy_from_user(value, uvalue, map->value_size) != 0) goto free_value; /* eBPF program that use maps are running under rcu_read_lock(), * therefore all map accessors rely on this fact, so do the same here */ rcu_read_lock(); err = map->ops->map_update_elem(map, key, value, attr->flags); rcu_read_unlock(); free_value: kfree(value);free_key: kfree(key);err_put: fdput(f); return err;} #define BPF_MAP_DELETE_ELEM_LAST_FIELD key static int map_delete_elem(union bpf_attr *attr){ void __user *ukey = u64_to_ptr(attr->key); int ufd = attr->map_fd; struct bpf_map *map; struct fd f; void *key; int err; if (CHECK_ATTR(BPF_MAP_DELETE_ELEM)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; rcu_read_lock(); err = map->ops->map_delete_elem(map, key); rcu_read_unlock(); free_key: kfree(key);err_put: fdput(f); return err;} /* last field in 'union bpf_attr' used by this command */#define BPF_MAP_GET_NEXT_KEY_LAST_FIELD next_key static int map_get_next_key(union bpf_attr *attr){ void __user *ukey = u64_to_ptr(attr->key); void __user *unext_key = u64_to_ptr(attr->next_key); int ufd = attr->map_fd; struct bpf_map *map; void *key, *next_key; struct fd f; int err; if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; err = -ENOMEM; next_key = kmalloc(map->key_size, GFP_USER); if (!next_key) goto free_key; rcu_read_lock(); err = map->ops->map_get_next_key(map, key, next_key); rcu_read_unlock(); if (err) goto free_next_key; err = -EFAULT; if (copy_to_user(unext_key, next_key, map->key_size) != 0) goto free_next_key; err = 0; free_next_key: kfree(next_key);free_key: kfree(key);err_put: fdput(f); return err;} static LIST_HEAD(bpf_prog_types); static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog){ struct bpf_prog_type_list *tl; list_for_each_entry(tl, &bpf_prog_types, list_node) { if (tl->type == type) { prog->aux->ops = tl->ops; prog->type = type; return 0; } } return -EINVAL;} void bpf_register_prog_type(struct bpf_prog_type_list *tl){ list_add(&tl->list_node, &bpf_prog_types);} /* fixup insn->imm field of bpf_call instructions: * if (insn->imm == BPF_FUNC_map_lookup_elem) * insn->imm = bpf_map_lookup_elem - __bpf_call_base; * else if (insn->imm == BPF_FUNC_map_update_elem) * insn->imm = bpf_map_update_elem - __bpf_call_base; * else ... * * this function is called after eBPF program passed verification */static void fixup_bpf_calls(struct bpf_prog *prog){ const struct bpf_func_proto *fn; int i; for (i = 0; i < prog->len; i++) { struct bpf_insn *insn = &prog->insnsi[i]; if (insn->code == (BPF_JMP | BPF_CALL)) { /* we reach here when program has bpf_call instructions * and it passed bpf_check(), means that * ops->get_func_proto must have been supplied, check it */ BUG_ON(!prog->aux->ops->get_func_proto); if (insn->imm == BPF_FUNC_get_route_realm) prog->dst_needed = 1; if (insn->imm == BPF_FUNC_get_prandom_u32) bpf_user_rnd_init_once(); if (insn->imm == BPF_FUNC_tail_call) { /* mark bpf_tail_call as different opcode * to avoid conditional branch in * interpeter for every normal call * and to prevent accidental JITing by * JIT compiler that doesn't support * bpf_tail_call yet */ insn->imm = 0; insn->code |= BPF_X; continue; } fn = prog->aux->ops->get_func_proto(insn->imm); /* all functions that have prototype and verifier allowed * programs to call them, must be real in-kernel functions */ BUG_ON(!fn->func); insn->imm = fn->func - __bpf_call_base; } }} /* drop refcnt on maps used by eBPF program and free auxilary data */static void free_used_maps(struct bpf_prog_aux *aux){ int i; for (i = 0; i < aux->used_map_cnt; i++) bpf_map_put(aux->used_maps[i]);Lines 1–500 of 781. Load more
/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com * * This program is free software; you can redistribute it and/or * modify it under the terms of version 2 of the GNU General Public * License as published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. */ #include <linux/bpf.h> #include <linux/syscalls.h> #include <linux/slab.h> #include <linux/anon_inodes.h> #include <linux/file.h> #include <linux/license.h> #include <linux/filter.h> #include <linux/version.h> int sysctl_unprivileged_bpf_disabled __read_mostly; static LIST_HEAD(bpf_map_types); static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) { struct bpf_map_type_list *tl; struct bpf_map *map; list_for_each_entry(tl, &bpf_map_types, list_node) { if (tl->type == attr->map_type) { map = tl->ops->map_alloc(attr); if (IS_ERR(map)) return map; map->ops = tl->ops; map->map_type = attr->map_type; return map; } } return ERR_PTR(-EINVAL); } /* boot time registration of different map implementations */ void bpf_register_map_type(struct bpf_map_type_list *tl) { list_add(&tl->list_node, &bpf_map_types); } static int bpf_map_charge_memlock(struct bpf_map *map) { struct user_struct *user = get_current_user(); unsigned long memlock_limit; memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; atomic_long_add(map->pages, &user->locked_vm); if (atomic_long_read(&user->locked_vm) > memlock_limit) { atomic_long_sub(map->pages, &user->locked_vm); free_uid(user); return -EPERM; } map->user = user; return 0; } static void bpf_map_uncharge_memlock(struct bpf_map *map) { struct user_struct *user = map->user; atomic_long_sub(map->pages, &user->locked_vm); free_uid(user); } /* called from workqueue */ static void bpf_map_free_deferred(struct work_struct *work) { struct bpf_map *map = container_of(work, struct bpf_map, work); bpf_map_uncharge_memlock(map); /* implementation dependent freeing */ map->ops->map_free(map); } static void bpf_map_put_uref(struct bpf_map *map) { if (atomic_dec_and_test(&map->usercnt)) { if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY) bpf_fd_array_map_clear(map); } } /* decrement map refcnt and schedule it for freeing via workqueue * (unrelying map implementation ops->map_free() might sleep) */ void bpf_map_put(struct bpf_map *map) { if (atomic_dec_and_test(&map->refcnt)) { INIT_WORK(&map->work, bpf_map_free_deferred); schedule_work(&map->work); } } void bpf_map_put_with_uref(struct bpf_map *map) { bpf_map_put_uref(map); bpf_map_put(map); } static int bpf_map_release(struct inode *inode, struct file *filp) { bpf_map_put_with_uref(filp->private_data); return 0; } static const struct file_operations bpf_map_fops = { .release = bpf_map_release, }; int bpf_map_new_fd(struct bpf_map *map) { return anon_inode_getfd("bpf-map", &bpf_map_fops, map, O_RDWR | O_CLOEXEC); } /* helper macro to check that unused fields 'union bpf_attr' are zero */ #define CHECK_ATTR(CMD) \ memchr_inv((void *) &attr->CMD##_LAST_FIELD + \ sizeof(attr->CMD##_LAST_FIELD), 0, \ sizeof(*attr) - \ offsetof(union bpf_attr, CMD##_LAST_FIELD) - \ sizeof(attr->CMD##_LAST_FIELD)) != NULL #define BPF_MAP_CREATE_LAST_FIELD max_entries /* called via syscall */ static int map_create(union bpf_attr *attr) { struct bpf_map *map; int err; err = CHECK_ATTR(BPF_MAP_CREATE); if (err) return -EINVAL; /* find map type and init map: hashtable vs rbtree vs bloom vs ... */ map = find_and_alloc_map(attr); if (IS_ERR(map)) return PTR_ERR(map); atomic_set(&map->refcnt, 1); atomic_set(&map->usercnt, 1); err = bpf_map_charge_memlock(map); if (err) goto free_map; err = bpf_map_new_fd(map); if (err < 0) /* failed to allocate fd */ goto free_map; return err; free_map: map->ops->map_free(map); return err; } /* if error is returned, fd is released. * On success caller should complete fd access with matching fdput() */ struct bpf_map *__bpf_map_get(struct fd f) { if (!f.file) return ERR_PTR(-EBADF); if (f.file->f_op != &bpf_map_fops) { fdput(f); return ERR_PTR(-EINVAL); } return f.file->private_data; } void bpf_map_inc(struct bpf_map *map, bool uref) { atomic_inc(&map->refcnt); if (uref) atomic_inc(&map->usercnt); } struct bpf_map *bpf_map_get_with_uref(u32 ufd) { struct fd f = fdget(ufd); struct bpf_map *map; map = __bpf_map_get(f); if (IS_ERR(map)) return map; bpf_map_inc(map, true); fdput(f); return map; } /* helper to convert user pointers passed inside __aligned_u64 fields */ static void __user *u64_to_ptr(__u64 val) { return (void __user *) (unsigned long) val; } /* last field in 'union bpf_attr' used by this command */ #define BPF_MAP_LOOKUP_ELEM_LAST_FIELD value static int map_lookup_elem(union bpf_attr *attr) { void __user *ukey = u64_to_ptr(attr->key); void __user *uvalue = u64_to_ptr(attr->value); int ufd = attr->map_fd; struct bpf_map *map; void *key, *value, *ptr; struct fd f; int err; if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; err = -ENOMEM; value = kmalloc(map->value_size, GFP_USER | __GFP_NOWARN); if (!value) goto free_key; rcu_read_lock(); ptr = map->ops->map_lookup_elem(map, key); if (ptr) memcpy(value, ptr, map->value_size); rcu_read_unlock(); err = -ENOENT; if (!ptr) goto free_value; err = -EFAULT; if (copy_to_user(uvalue, value, map->value_size) != 0) goto free_value; err = 0; free_value: kfree(value); free_key: kfree(key); err_put: fdput(f); return err; } #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags static int map_update_elem(union bpf_attr *attr) { void __user *ukey = u64_to_ptr(attr->key); void __user *uvalue = u64_to_ptr(attr->value); int ufd = attr->map_fd; struct bpf_map *map; void *key, *value; struct fd f; int err; if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; err = -ENOMEM; value = kmalloc(map->value_size, GFP_USER | __GFP_NOWARN); if (!value) goto free_key; err = -EFAULT; if (copy_from_user(value, uvalue, map->value_size) != 0) goto free_value; /* eBPF program that use maps are running under rcu_read_lock(), * therefore all map accessors rely on this fact, so do the same here */ rcu_read_lock(); err = map->ops->map_update_elem(map, key, value, attr->flags); rcu_read_unlock(); free_value: kfree(value); free_key: kfree(key); err_put: fdput(f); return err; } #define BPF_MAP_DELETE_ELEM_LAST_FIELD key static int map_delete_elem(union bpf_attr *attr) { void __user *ukey = u64_to_ptr(attr->key); int ufd = attr->map_fd; struct bpf_map *map; struct fd f; void *key; int err; if (CHECK_ATTR(BPF_MAP_DELETE_ELEM)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; rcu_read_lock(); err = map->ops->map_delete_elem(map, key); rcu_read_unlock(); free_key: kfree(key); err_put: fdput(f); return err; } /* last field in 'union bpf_attr' used by this command */ #define BPF_MAP_GET_NEXT_KEY_LAST_FIELD next_key static int map_get_next_key(union bpf_attr *attr) { void __user *ukey = u64_to_ptr(attr->key); void __user *unext_key = u64_to_ptr(attr->next_key); int ufd = attr->map_fd; struct bpf_map *map; void *key, *next_key; struct fd f; int err; if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY)) return -EINVAL; f = fdget(ufd); map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); err = -ENOMEM; key = kmalloc(map->key_size, GFP_USER); if (!key) goto err_put; err = -EFAULT; if (copy_from_user(key, ukey, map->key_size) != 0) goto free_key; err = -ENOMEM; next_key = kmalloc(map->key_size, GFP_USER); if (!next_key) goto free_key; rcu_read_lock(); err = map->ops->map_get_next_key(map, key, next_key); rcu_read_unlock(); if (err) goto free_next_key; err = -EFAULT; if (copy_to_user(unext_key, next_key, map->key_size) != 0) goto free_next_key; err = 0; free_next_key: kfree(next_key); free_key: kfree(key); err_put: fdput(f); return err; } static LIST_HEAD(bpf_prog_types); static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog) { struct bpf_prog_type_list *tl; list_for_each_entry(tl, &bpf_prog_types, list_node) { if (tl->type == type) { prog->aux->ops = tl->ops; prog->type = type; return 0; } } return -EINVAL; } void bpf_register_prog_type(struct bpf_prog_type_list *tl) { list_add(&tl->list_node, &bpf_prog_types); } /* fixup insn->imm field of bpf_call instructions: * if (insn->imm == BPF_FUNC_map_lookup_elem) * insn->imm = bpf_map_lookup_elem - __bpf_call_base; * else if (insn->imm == BPF_FUNC_map_update_elem) * insn->imm = bpf_map_update_elem - __bpf_call_base; * else ... * * this function is called after eBPF program passed verification */ static void fixup_bpf_calls(struct bpf_prog *prog) { const struct bpf_func_proto *fn; int i; for (i = 0; i < prog->len; i++) { struct bpf_insn *insn = &prog->insnsi[i]; if (insn->code == (BPF_JMP | BPF_CALL)) { /* we reach here when program has bpf_call instructions * and it passed bpf_check(), means that * ops->get_func_proto must have been supplied, check it */ BUG_ON(!prog->aux->ops->get_func_proto); if (insn->imm == BPF_FUNC_get_route_realm) prog->dst_needed = 1; if (insn->imm == BPF_FUNC_get_prandom_u32) bpf_user_rnd_init_once(); if (insn->imm == BPF_FUNC_tail_call) { /* mark bpf_tail_call as different opcode * to avoid conditional branch in * interpeter for every normal call * and to prevent accidental JITing by * JIT compiler that doesn't support * bpf_tail_call yet */ insn->imm = 0; insn->code |= BPF_X; continue; } fn = prog->aux->ops->get_func_proto(insn->imm); /* all functions that have prototype and verifier allowed * programs to call them, must be real in-kernel functions */ BUG_ON(!fn->func); insn->imm = fn->func - __bpf_call_base; } } } /* drop refcnt on maps used by eBPF program and free auxilary data */ static void free_used_maps(struct bpf_prog_aux *aux) { int i; for (i = 0; i < aux->used_map_cnt; i++) bpf_map_put(aux->used_maps[i]);