History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says: ==================== pull-request: bpf 2019-03-29 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Bug fix in BTF deduplication that was mishandling an equivalence comparison, from Andrii. 2) libbpf Makefile fixes to properly link against libelf for the shared object and to actually export AF_XDP's xsk.h header, from Björn. 3) Fix use after free in bpf inode eviction, from Daniel. 4) Fix a bug in skb creation out of cpumap redirect, from Jesper. 5) Remove an unnecessary and triggerable WARN_ONCE() in max number of call stack frames checking in verifier, from Paul. ====================

David S. Miller committed 7 years ago

Commit 22bdf7d2 parents 19c8474 676e4a68 files · +127 −26Browse files

Unified · Split

8 files
  1. Documentation/bpf/btf.rst +4 −4
  2. kernel/bpf/cpumap.c +10 −3
  3. kernel/bpf/inode.c +18 −14
  4. kernel/bpf/verifier.c +3 −2
  5. tools/lib/bpf/Makefile +4 −3
  6. tools/lib/bpf/btf.c +3 −0
  7. tools/testing/selftests/bpf/test_btf.c +47 −0
  8. tools/testing/selftests/bpf/verifier/calls.c +38 −0
Documentation/bpf/btf.rst+4−4
@@ -148,16 +148,16 @@ The ``btf_type.size * 8`` must be equal to or greater than ``BTF_INT_BITS()`` · 147 unmodified lines
148148 for the type. The maximum value of ``BTF_INT_BITS()`` is 128.
149149
150150 The ``BTF_INT_OFFSET()`` specifies the starting bit offset to calculate values
151−for this int. For example, a bitfield struct member has: * btf member bit
152−offset 100 from the start of the structure, * btf member pointing to an int
153−type, * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
151+for this int. For example, a bitfield struct member has:
152+ * btf member bit offset 100 from the start of the structure,
153+ * btf member pointing to an int type,
154+ * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
154155
155156 Then in the struct memory layout, this member will occupy ``4`` bits starting
156157 from bits ``100 + 2 = 102``.
157158
158159 Alternatively, the bitfield struct member can be the following to access the
159160 same bits as the above:
160−
161161 * btf member bit offset 102,
162162 * btf member pointing to an int type,
163163 * the int type has ``BTF_INT_OFFSET() = 0`` and ``BTF_INT_BITS() = 4``
kernel/bpf/cpumap.c+10−3
@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work) · 161 unmodified lines
162162 static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
163163 struct xdp_frame *xdpf)
164164 {
165+ unsigned int hard_start_headroom;
165166 unsigned int frame_size;
166167 void *pkt_data_start;
167168 struct sk_buff *skb;
168169
170+ /* Part of headroom was reserved to xdpf */
171+ hard_start_headroom = sizeof(struct xdp_frame) + xdpf->headroom;
172+
169173 /* build_skb need to place skb_shared_info after SKB end, and
170174 * also want to know the memory "truesize". Thus, need to
171175 * know the memory frame size backing xdp_buff.
@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu, · 11 unmodified lines
183187 * is not at a fixed memory location, with mixed length
184188 * packets, which is bad for cache-line hotness.
185189 */
186− frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
190+ frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
187191 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
188192
189− pkt_data_start = xdpf->data - xdpf->headroom;
193+ pkt_data_start = xdpf->data - hard_start_headroom;
190194 skb = build_skb(pkt_data_start, frame_size);
191195 if (!skb)
192196 return NULL;
193197
194− skb_reserve(skb, xdpf->headroom);
198+ skb_reserve(skb, hard_start_headroom);
195199 __skb_put(skb, xdpf->len);
196200 if (xdpf->metasize)
197201 skb_metadata_set(skb, xdpf->metasize);
@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu, · 7 unmodified lines
205209 * - RX ring dev queue index (skb_record_rx_queue)
206210 */
207211
212+ /* Allow SKB to reuse area used by xdp_frame */
213+ xdp_scrub_frame(xdpf);
214+
208215 return skb;
209216 }
210217
kernel/bpf/inode.c+18−14
@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ · 553 unmodified lines
554554 }
555555 EXPORT_SYMBOL(bpf_prog_get_type_path);
556556
557−static void bpf_evict_inode(struct inode *inode)
558−{
559− enum bpf_type type;
560−
561− truncate_inode_pages_final(&inode->i_data);
562− clear_inode(inode);
563−
564− if (S_ISLNK(inode->i_mode))
565− kfree(inode->i_link);
566− if (!bpf_inode_type(inode, &type))
567− bpf_any_put(inode->i_private, type);
568−}
569−
570557 /*
571558 * Display the mount options in /proc/mounts.
572559 */
@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) · 6 unmodified lines
579566 return 0;
580567 }
581568
569+static void bpf_destroy_inode_deferred(struct rcu_head *head)
570+{
571+ struct inode *inode = container_of(head, struct inode, i_rcu);
572+ enum bpf_type type;
573+
574+ if (S_ISLNK(inode->i_mode))
575+ kfree(inode->i_link);
576+ if (!bpf_inode_type(inode, &type))
577+ bpf_any_put(inode->i_private, type);
578+ free_inode_nonrcu(inode);
579+}
580+
581+static void bpf_destroy_inode(struct inode *inode)
582+{
583+ call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
584+}
585+
582586 static const struct super_operations bpf_super_ops = {
583587 .statfs = simple_statfs,
584588 .drop_inode = generic_delete_inode,
585589 .show_options = bpf_show_options,
586− .evict_inode = bpf_evict_inode,
590+ .destroy_inode = bpf_destroy_inode,
587591 };
588592
589593 enum {
kernel/bpf/verifier.c+3−2
@@ -1897,8 +1897,9 @@ continue_func: · 1896 unmodified lines
18971897 }
18981898 frame++;
18991899 if (frame >= MAX_CALL_FRAMES) {
1900− WARN_ONCE(1, "verifier bug. Call stack is too deep\n");
1901− return -EFAULT;
1900+ verbose(env, "the call stack of %d frames is too deep !\n",
1901+ frame);
1902+ return -E2BIG;
19021903 }
19031904 goto process_func;
19041905 }
tools/lib/bpf/Makefile+4−3
@@ -177,7 +177,7 @@ $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION) · 176 unmodified lines
177177
178178 $(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN)
179179 $(QUIET_LINK)$(CC) --shared -Wl,-soname,libbpf.so.$(VERSION) \
180− -Wl,--version-script=$(VERSION_SCRIPT) $^ -o $@
180+ -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -o $@
181181 @ln -sf $(@F) $(OUTPUT)libbpf.so
182182 @ln -sf $(@F) $(OUTPUT)libbpf.so.$(VERSION)
183183
@@ -220,8 +220,9 @@ install_lib: all_cmd · 36 unmodified lines
220220 install_headers:
221221 $(call QUIET_INSTALL, headers) \
222222 $(call do_install,bpf.h,$(prefix)/include/bpf,644); \
223− $(call do_install,libbpf.h,$(prefix)/include/bpf,644);
224− $(call do_install,btf.h,$(prefix)/include/bpf,644);
223+ $(call do_install,libbpf.h,$(prefix)/include/bpf,644); \
224+ $(call do_install,btf.h,$(prefix)/include/bpf,644); \
225+ $(call do_install,xsk.h,$(prefix)/include/bpf,644);
225226
226227 install: install_lib
227228
tools/lib/bpf/btf.c+3−0
@@ -2107,6 +2107,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id, · 2106 unmodified lines
21072107 return fwd_kind == real_kind;
21082108 }
21092109
2110+ if (cand_kind != canon_kind)
2111+ return 0;
2112+
21102113 switch (cand_kind) {
21112114 case BTF_KIND_INT:
21122115 return btf_equal_int(cand_type, canon_type);
tools/testing/selftests/bpf/test_btf.c+47−0
@@ -5776,6 +5776,53 @@ const struct btf_dedup_test dedup_tests[] = { · 5775 unmodified lines
57765776 .dedup_table_size = 1, /* force hash collisions */
57775777 },
57785778 },
5779+{
5780+ .descr = "dedup: void equiv check",
5781+ /*
5782+ * // CU 1:
5783+ * struct s {
5784+ * struct {} *x;
5785+ * };
5786+ * // CU 2:
5787+ * struct s {
5788+ * int *x;
5789+ * };
5790+ */
5791+ .input = {
5792+ .raw_types = {
5793+ /* CU 1 */
5794+ BTF_STRUCT_ENC(0, 0, 1), /* [1] struct {} */
5795+ BTF_PTR_ENC(1), /* [2] ptr -> [1] */
5796+ BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [3] struct s */
5797+ BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
5798+ /* CU 2 */
5799+ BTF_PTR_ENC(0), /* [4] ptr -> void */
5800+ BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [5] struct s */
5801+ BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
5802+ BTF_END_RAW,
5803+ },
5804+ BTF_STR_SEC("\0s\0x"),
5805+ },
5806+ .expect = {
5807+ .raw_types = {
5808+ /* CU 1 */
5809+ BTF_STRUCT_ENC(0, 0, 1), /* [1] struct {} */
5810+ BTF_PTR_ENC(1), /* [2] ptr -> [1] */
5811+ BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [3] struct s */
5812+ BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
5813+ /* CU 2 */
5814+ BTF_PTR_ENC(0), /* [4] ptr -> void */
5815+ BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [5] struct s */
5816+ BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
5817+ BTF_END_RAW,
5818+ },
5819+ BTF_STR_SEC("\0s\0x"),
5820+ },
5821+ .opts = {
5822+ .dont_resolve_fwds = false,
5823+ .dedup_table_size = 1, /* force hash collisions */
5824+ },
5825+},
57795826 {
57805827 .descr = "dedup: all possible kinds (no duplicates)",
57815828 .input = {
tools/testing/selftests/bpf/verifier/calls.c+38−0
@@ -907,6 +907,44 @@ · 906 unmodified lines
907907 .errstr = "call stack",
908908 .result = REJECT,
909909 },
910+{
911+ "calls: stack depth check in dead code",
912+ .insns = {
913+ /* main */
914+ BPF_MOV64_IMM(BPF_REG_1, 0),
915+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
916+ BPF_EXIT_INSN(),
917+ /* A */
918+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
919+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */
920+ BPF_MOV64_IMM(BPF_REG_0, 0),
921+ BPF_EXIT_INSN(),
922+ /* B */
923+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
924+ BPF_EXIT_INSN(),
925+ /* C */
926+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
927+ BPF_EXIT_INSN(),
928+ /* D */
929+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
930+ BPF_EXIT_INSN(),
931+ /* E */
932+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
933+ BPF_EXIT_INSN(),
934+ /* F */
935+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
936+ BPF_EXIT_INSN(),
937+ /* G */
938+ BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
939+ BPF_EXIT_INSN(),
940+ /* H */
941+ BPF_MOV64_IMM(BPF_REG_0, 0),
942+ BPF_EXIT_INSN(),
943+ },
944+ .prog_type = BPF_PROG_TYPE_XDP,
945+ .errstr = "call stack",
946+ .result = REJECT,
947+},
910948 {
911949 "calls: spill into caller stack frame",
912950 .insns = {