History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says: ==================== pull-request: bpf 2019-03-29 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Bug fix in BTF deduplication that was mishandling an equivalence comparison, from Andrii. 2) libbpf Makefile fixes to properly link against libelf for the shared object and to actually export AF_XDP's xsk.h header, from Björn. 3) Fix use after free in bpf inode eviction, from Daniel. 4) Fix a bug in skb creation out of cpumap redirect, from Jesper. 5) Remove an unnecessary and triggerable WARN_ONCE() in max number of call stack frames checking in verifier, from Paul. ====================

David S. Miller committed 7 years ago

Commit 22bdf7d2 parents 19c8474 676e4a68 files · +127 −26Browse files

Showing the changes to kernel (3 of 8 files). Show all

Unified · Split

3 files
  1. kernel/bpf/cpumap.c +10 −3
  2. kernel/bpf/inode.c +18 −14
  3. kernel/bpf/verifier.c +3 −2
kernel/bpf/cpumap.c+10−3
@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work) · 161 unmodified lines
162162 static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
163163 struct xdp_frame *xdpf)
164164 {
165+ unsigned int hard_start_headroom;
165166 unsigned int frame_size;
166167 void *pkt_data_start;
167168 struct sk_buff *skb;
168169
170+ /* Part of headroom was reserved to xdpf */
171+ hard_start_headroom = sizeof(struct xdp_frame) + xdpf->headroom;
172+
169173 /* build_skb need to place skb_shared_info after SKB end, and
170174 * also want to know the memory "truesize". Thus, need to
171175 * know the memory frame size backing xdp_buff.
@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu, · 11 unmodified lines
183187 * is not at a fixed memory location, with mixed length
184188 * packets, which is bad for cache-line hotness.
185189 */
186− frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
190+ frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
187191 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
188192
189− pkt_data_start = xdpf->data - xdpf->headroom;
193+ pkt_data_start = xdpf->data - hard_start_headroom;
190194 skb = build_skb(pkt_data_start, frame_size);
191195 if (!skb)
192196 return NULL;
193197
194− skb_reserve(skb, xdpf->headroom);
198+ skb_reserve(skb, hard_start_headroom);
195199 __skb_put(skb, xdpf->len);
196200 if (xdpf->metasize)
197201 skb_metadata_set(skb, xdpf->metasize);
@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu, · 7 unmodified lines
205209 * - RX ring dev queue index (skb_record_rx_queue)
206210 */
207211
212+ /* Allow SKB to reuse area used by xdp_frame */
213+ xdp_scrub_frame(xdpf);
214+
208215 return skb;
209216 }
210217
kernel/bpf/inode.c+18−14
@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ · 553 unmodified lines
554554 }
555555 EXPORT_SYMBOL(bpf_prog_get_type_path);
556556
557−static void bpf_evict_inode(struct inode *inode)
558−{
559− enum bpf_type type;
560−
561− truncate_inode_pages_final(&inode->i_data);
562− clear_inode(inode);
563−
564− if (S_ISLNK(inode->i_mode))
565− kfree(inode->i_link);
566− if (!bpf_inode_type(inode, &type))
567− bpf_any_put(inode->i_private, type);
568−}
569−
570557 /*
571558 * Display the mount options in /proc/mounts.
572559 */
@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) · 6 unmodified lines
579566 return 0;
580567 }
581568
569+static void bpf_destroy_inode_deferred(struct rcu_head *head)
570+{
571+ struct inode *inode = container_of(head, struct inode, i_rcu);
572+ enum bpf_type type;
573+
574+ if (S_ISLNK(inode->i_mode))
575+ kfree(inode->i_link);
576+ if (!bpf_inode_type(inode, &type))
577+ bpf_any_put(inode->i_private, type);
578+ free_inode_nonrcu(inode);
579+}
580+
581+static void bpf_destroy_inode(struct inode *inode)
582+{
583+ call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
584+}
585+
582586 static const struct super_operations bpf_super_ops = {
583587 .statfs = simple_statfs,
584588 .drop_inode = generic_delete_inode,
585589 .show_options = bpf_show_options,
586− .evict_inode = bpf_evict_inode,
590+ .destroy_inode = bpf_destroy_inode,
587591 };
588592
589593 enum {
kernel/bpf/verifier.c+3−2
@@ -1897,8 +1897,9 @@ continue_func: · 1896 unmodified lines
18971897 }
18981898 frame++;
18991899 if (frame >= MAX_CALL_FRAMES) {
1900− WARN_ONCE(1, "verifier bug. Call stack is too deep\n");
1901− return -EFAULT;
1900+ verbose(env, "the call stack of %d frames is too deep !\n",
1901+ frame);
1902+ return -E2BIG;
19021903 }
19031904 goto process_func;
19041905 }