History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says: ==================== pull-request: bpf 2019-03-29 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Bug fix in BTF deduplication that was mishandling an equivalence comparison, from Andrii. 2) libbpf Makefile fixes to properly link against libelf for the shared object and to actually export AF_XDP's xsk.h header, from Björn. 3) Fix use after free in bpf inode eviction, from Daniel. 4) Fix a bug in skb creation out of cpumap redirect, from Jesper. 5) Remove an unnecessary and triggerable WARN_ONCE() in max number of call stack frames checking in verifier, from Paul. ====================

David S. Miller committed 7 years ago

Commit 22bdf7d2 parents 19c8474 676e4a68 files · +127 −26Browse files

Unified · Split

8 files
  1. Documentation/bpf/btf.rst +4 −4
  2. kernel/bpf/cpumap.c +10 −3
  3. kernel/bpf/inode.c +18 −14
  4. kernel/bpf/verifier.c +3 −2
  5. tools/lib/bpf/Makefile +4 −3
  6. tools/lib/bpf/btf.c +3 −0
  7. tools/testing/selftests/bpf/test_btf.c +47 −0
  8. tools/testing/selftests/bpf/verifier/calls.c +38 −0
Documentation/bpf/btf.rst+4−4
@@ -148,16 +148,16 @@ The ``btf_type.size * 8`` must be equal to or greater than ``BTF_INT_BITS()`` · 147 unmodified lines
148for the type. The maximum value of ``BTF_INT_BITS()`` is 128.148for the type. The maximum value of ``BTF_INT_BITS()`` is 128.
149 149
150The ``BTF_INT_OFFSET()`` specifies the starting bit offset to calculate values150The ``BTF_INT_OFFSET()`` specifies the starting bit offset to calculate values
151for this int. For example, a bitfield struct member has: * btf member bit151for this int. For example, a bitfield struct member has:
152offset 100 from the start of the structure, * btf member pointing to an int152 * btf member bit offset 100 from the start of the structure,
153type, * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``153 * btf member pointing to an int type,
154 * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
154 155
155Then in the struct memory layout, this member will occupy ``4`` bits starting156Then in the struct memory layout, this member will occupy ``4`` bits starting
156from bits ``100 + 2 = 102``.157from bits ``100 + 2 = 102``.
157 158
158Alternatively, the bitfield struct member can be the following to access the159Alternatively, the bitfield struct member can be the following to access the
159same bits as the above:160same bits as the above:
160
161 * btf member bit offset 102,161 * btf member bit offset 102,
162 * btf member pointing to an int type,162 * btf member pointing to an int type,
163 * the int type has ``BTF_INT_OFFSET() = 0`` and ``BTF_INT_BITS() = 4``163 * the int type has ``BTF_INT_OFFSET() = 0`` and ``BTF_INT_BITS() = 4``
kernel/bpf/cpumap.c+10−3
@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work) · 161 unmodified lines
162static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,162static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
163 struct xdp_frame *xdpf)163 struct xdp_frame *xdpf)
164{164{
165 unsigned int hard_start_headroom;
165 unsigned int frame_size;166 unsigned int frame_size;
166 void *pkt_data_start;167 void *pkt_data_start;
167 struct sk_buff *skb;168 struct sk_buff *skb;
168 169
170 /* Part of headroom was reserved to xdpf */
171 hard_start_headroom = sizeof(struct xdp_frame) + xdpf->headroom;
172
169 /* build_skb need to place skb_shared_info after SKB end, and173 /* build_skb need to place skb_shared_info after SKB end, and
170 * also want to know the memory "truesize". Thus, need to174 * also want to know the memory "truesize". Thus, need to
171 * know the memory frame size backing xdp_buff.175 * know the memory frame size backing xdp_buff.
@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu, · 11 unmodified lines
183 * is not at a fixed memory location, with mixed length187 * is not at a fixed memory location, with mixed length
184 * packets, which is bad for cache-line hotness.188 * packets, which is bad for cache-line hotness.
185 */189 */
186 frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +190 frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
187 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));191 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
188 192
189 pkt_data_start = xdpf->data - xdpf->headroom;193 pkt_data_start = xdpf->data - hard_start_headroom;
190 skb = build_skb(pkt_data_start, frame_size);194 skb = build_skb(pkt_data_start, frame_size);
191 if (!skb)195 if (!skb)
192 return NULL;196 return NULL;
193 197
194 skb_reserve(skb, xdpf->headroom);198 skb_reserve(skb, hard_start_headroom);
195 __skb_put(skb, xdpf->len);199 __skb_put(skb, xdpf->len);
196 if (xdpf->metasize)200 if (xdpf->metasize)
197 skb_metadata_set(skb, xdpf->metasize);201 skb_metadata_set(skb, xdpf->metasize);
@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu, · 7 unmodified lines
205 * - RX ring dev queue index (skb_record_rx_queue)209 * - RX ring dev queue index (skb_record_rx_queue)
206 */210 */
207 211
212 /* Allow SKB to reuse area used by xdp_frame */
213 xdp_scrub_frame(xdpf);
214
208 return skb;215 return skb;
209}216}
210 217
kernel/bpf/inode.c+18−14
@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ · 553 unmodified lines
554}554}
555EXPORT_SYMBOL(bpf_prog_get_type_path);555EXPORT_SYMBOL(bpf_prog_get_type_path);
556 556
557static void bpf_evict_inode(struct inode *inode)
558{
559 enum bpf_type type;
560
561 truncate_inode_pages_final(&inode->i_data);
562 clear_inode(inode);
563
564 if (S_ISLNK(inode->i_mode))
565 kfree(inode->i_link);
566 if (!bpf_inode_type(inode, &type))
567 bpf_any_put(inode->i_private, type);
568}
569
570/*557/*
571 * Display the mount options in /proc/mounts.558 * Display the mount options in /proc/mounts.
572 */559 */
@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) · 6 unmodified lines
579 return 0;566 return 0;
580}567}
581 568
569static void bpf_destroy_inode_deferred(struct rcu_head *head)
570{
571 struct inode *inode = container_of(head, struct inode, i_rcu);
572 enum bpf_type type;
573
574 if (S_ISLNK(inode->i_mode))
575 kfree(inode->i_link);
576 if (!bpf_inode_type(inode, &type))
577 bpf_any_put(inode->i_private, type);
578 free_inode_nonrcu(inode);
579}
580
581static void bpf_destroy_inode(struct inode *inode)
582{
583 call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
584}
585
582static const struct super_operations bpf_super_ops = {586static const struct super_operations bpf_super_ops = {
583 .statfs = simple_statfs,587 .statfs = simple_statfs,
584 .drop_inode = generic_delete_inode,588 .drop_inode = generic_delete_inode,
585 .show_options = bpf_show_options,589 .show_options = bpf_show_options,
586 .evict_inode = bpf_evict_inode,590 .destroy_inode = bpf_destroy_inode,
587};591};
588 592
589enum {593enum {
kernel/bpf/verifier.c+3−2
@@ -1897,8 +1897,9 @@ continue_func: · 1896 unmodified lines
1897 }1897 }
1898 frame++;1898 frame++;
1899 if (frame >= MAX_CALL_FRAMES) {1899 if (frame >= MAX_CALL_FRAMES) {
1900 WARN_ONCE(1, "verifier bug. Call stack is too deep\n");1900 verbose(env, "the call stack of %d frames is too deep !\n",
1901 return -EFAULT;1901 frame);
1902 return -E2BIG;
1902 }1903 }
1903 goto process_func;1904 goto process_func;
1904 }1905 }
tools/lib/bpf/Makefile+4−3
@@ -177,7 +177,7 @@ $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION) · 176 unmodified lines
177 177
178$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN)178$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN)
179 $(QUIET_LINK)$(CC) --shared -Wl,-soname,libbpf.so.$(VERSION) \179 $(QUIET_LINK)$(CC) --shared -Wl,-soname,libbpf.so.$(VERSION) \
180 -Wl,--version-script=$(VERSION_SCRIPT) $^ -o $@180 -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -o $@
181 @ln -sf $(@F) $(OUTPUT)libbpf.so181 @ln -sf $(@F) $(OUTPUT)libbpf.so
182 @ln -sf $(@F) $(OUTPUT)libbpf.so.$(VERSION)182 @ln -sf $(@F) $(OUTPUT)libbpf.so.$(VERSION)
183 183
@@ -220,8 +220,9 @@ install_lib: all_cmd · 36 unmodified lines
220install_headers:220install_headers:
221 $(call QUIET_INSTALL, headers) \221 $(call QUIET_INSTALL, headers) \
222 $(call do_install,bpf.h,$(prefix)/include/bpf,644); \222 $(call do_install,bpf.h,$(prefix)/include/bpf,644); \
223 $(call do_install,libbpf.h,$(prefix)/include/bpf,644);223 $(call do_install,libbpf.h,$(prefix)/include/bpf,644); \
224 $(call do_install,btf.h,$(prefix)/include/bpf,644);224 $(call do_install,btf.h,$(prefix)/include/bpf,644); \
225 $(call do_install,xsk.h,$(prefix)/include/bpf,644);
225 226
226install: install_lib227install: install_lib
227 228
tools/lib/bpf/btf.c+3−0
@@ -2107,6 +2107,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id, · 2106 unmodified lines
2107 return fwd_kind == real_kind;2107 return fwd_kind == real_kind;
2108 }2108 }
2109 2109
2110 if (cand_kind != canon_kind)
2111 return 0;
2112
2110 switch (cand_kind) {2113 switch (cand_kind) {
2111 case BTF_KIND_INT:2114 case BTF_KIND_INT:
2112 return btf_equal_int(cand_type, canon_type);2115 return btf_equal_int(cand_type, canon_type);
tools/testing/selftests/bpf/test_btf.c+47−0
@@ -5776,6 +5776,53 @@ const struct btf_dedup_test dedup_tests[] = { · 5775 unmodified lines
5776 .dedup_table_size = 1, /* force hash collisions */5776 .dedup_table_size = 1, /* force hash collisions */
5777 },5777 },
5778},5778},
5779{
5780 .descr = "dedup: void equiv check",
5781 /*
5782 * // CU 1:
5783 * struct s {
5784 * struct {} *x;
5785 * };
5786 * // CU 2:
5787 * struct s {
5788 * int *x;
5789 * };
5790 */
5791 .input = {
5792 .raw_types = {
5793 /* CU 1 */
5794 BTF_STRUCT_ENC(0, 0, 1), /* [1] struct {} */
5795 BTF_PTR_ENC(1), /* [2] ptr -> [1] */
5796 BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [3] struct s */
5797 BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
5798 /* CU 2 */
5799 BTF_PTR_ENC(0), /* [4] ptr -> void */
5800 BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [5] struct s */
5801 BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
5802 BTF_END_RAW,
5803 },
5804 BTF_STR_SEC("\0s\0x"),
5805 },
5806 .expect = {
5807 .raw_types = {
5808 /* CU 1 */
5809 BTF_STRUCT_ENC(0, 0, 1), /* [1] struct {} */
5810 BTF_PTR_ENC(1), /* [2] ptr -> [1] */
5811 BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [3] struct s */
5812 BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
5813 /* CU 2 */
5814 BTF_PTR_ENC(0), /* [4] ptr -> void */
5815 BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [5] struct s */
5816 BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
5817 BTF_END_RAW,
5818 },
5819 BTF_STR_SEC("\0s\0x"),
5820 },
5821 .opts = {
5822 .dont_resolve_fwds = false,
5823 .dedup_table_size = 1, /* force hash collisions */
5824 },
5825},
5779{5826{
5780 .descr = "dedup: all possible kinds (no duplicates)",5827 .descr = "dedup: all possible kinds (no duplicates)",
5781 .input = {5828 .input = {
tools/testing/selftests/bpf/verifier/calls.c+38−0
@@ -907,6 +907,44 @@ · 906 unmodified lines
907 .errstr = "call stack",907 .errstr = "call stack",
908 .result = REJECT,908 .result = REJECT,
909},909},
910{
911 "calls: stack depth check in dead code",
912 .insns = {
913 /* main */
914 BPF_MOV64_IMM(BPF_REG_1, 0),
915 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
916 BPF_EXIT_INSN(),
917 /* A */
918 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
919 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */
920 BPF_MOV64_IMM(BPF_REG_0, 0),
921 BPF_EXIT_INSN(),
922 /* B */
923 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
924 BPF_EXIT_INSN(),
925 /* C */
926 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
927 BPF_EXIT_INSN(),
928 /* D */
929 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
930 BPF_EXIT_INSN(),
931 /* E */
932 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
933 BPF_EXIT_INSN(),
934 /* F */
935 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
936 BPF_EXIT_INSN(),
937 /* G */
938 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
939 BPF_EXIT_INSN(),
940 /* H */
941 BPF_MOV64_IMM(BPF_REG_0, 0),
942 BPF_EXIT_INSN(),
943 },
944 .prog_type = BPF_PROG_TYPE_XDP,
945 .errstr = "call stack",
946 .result = REJECT,
947},
910{948{
911 "calls: spill into caller stack frame",949 "calls: spill into caller stack frame",
912 .insns = {950 .insns = {