Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel borkmann says: ==================== The following pull-request contains BPF updates for your *net* tree. We've added 11 non-merge commits during the last 14 day(s) which contain a total of 13 files changed, 61 insertions(+), 24 deletions(-). The main changes are: 1) Fix BPF verifier's precision tracking around BPF ring buffer, from Kumar Kartikeya Dwivedi. 2) Fix regression in tunnel key infra when passing FLOWI_FLAG_ANYSRC, from Eyal Birger. 3) Fix insufficient permissions for bpf_sys_bpf() helper, from YiFei Zhu. 4) Fix splat from hitting BUG when purging effective cgroup programs, from Pu Lehui. 5) Fix range tracking for array poke descriptors, from Daniel Borkmann. 6) Fix corrupted packets for XDP_SHARED_UMEM in aligned mode, from Magnus Karlsson. 7) Fix NULL pointer splat in BPF sockmap sk_msg_recvmsg(), from Liu Jian. 8) Add READ_ONCE() to bpf_jit_limit when reading from sysctl, from Kuniyuki Iwashima. 9) Add BPF selftest lru_bug check to s390x deny list, from Daniel Müller. ====================

David S. Miller committed 4 years ago

Commit 2e085ec2 parents 4ba9d38 a65718213 files · +61 −24Browse files

Unified · Split

13 files

drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +2 −1
include/net/ip_tunnels.h +3 −1
include/uapi/linux/bpf.h +1 −1
kernel/bpf/cgroup.c +3 −1
kernel/bpf/core.c +1 −1
kernel/bpf/syscall.c +1 −1
kernel/bpf/verifier.c +7 −6
net/core/skmsg.c +2 −2
net/ipv4/ip_gre.c +1 −1
net/ipv4/ip_tunnel.c +4 −3
net/xdp/xsk_buff_pool.c +10 −6
tools/testing/selftests/bpf/DENYLIST.s390x +1 −0
tools/testing/selftests/bpf/verifier/precise.c +25 −0

drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c+2−1

@@ -423,7 +423,8 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev, · 422 unmodified lines
423	423
424	424	parms = mlxsw_sp_ipip_netdev_parms4(to_dev);
425	425	ip_tunnel_init_flow(&fl4, parms.iph.protocol, daddrp, saddrp,
426		− 0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0);
	426	+ 0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0,
	427	+ 0);
427	428
428	429	rt = ip_route_output_key(tun->net, &fl4);
429	430	if (IS_ERR(rt))

include/net/ip_tunnels.h+3−1

@@ -246,7 +246,8 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4, · 245 unmodified lines
246	246	__be32 daddr, __be32 saddr,
247	247	__be32 key, __u8 tos,
248	248	struct net *net, int oif,
249		− __u32 mark, __u32 tun_inner_hash)
	249	+ __u32 mark, __u32 tun_inner_hash,
	250	+ __u8 flow_flags)
250	251	{
251	252	memset(fl4, 0, sizeof(*fl4));
252	253
@@ -263,6 +264,7 @@ static inline void ip_tunnel_init_flow(struct flowi4 *fl4, · 10 unmodified lines
263	264	fl4->fl4_gre_key = key;
264	265	fl4->flowi4_mark = mark;
265	266	fl4->flowi4_multipath_hash = tun_inner_hash;
	267	+ fl4->flowi4_flags = flow_flags;
266	268	}
267	269
268	270	int ip_tunnel_init(struct net_device *dev);

include/uapi/linux/bpf.h+1−1

@@ -79,7 +79,7 @@ struct bpf_insn { · 78 unmodified lines
79	79	/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry */
80	80	struct bpf_lpm_trie_key {
81	81	__u32 prefixlen; /* up to 32 for AF_INET, 128 for AF_INET6 */
82		− __u8 data[]; /* Arbitrary size */
	82	+ __u8 data[0]; /* Arbitrary size */
83	83	};
84	84
85	85	struct bpf_cgroup_storage_key {

kernel/bpf/cgroup.c+3−1

@@ -921,8 +921,10 @@ static void purge_effective_progs(struct cgroup cgrp, struct bpf_prog prog, · 920 unmodified lines
921	921	pos++;
922	922	}
923	923	}
	924	+
	925	+ /* no link or prog match, skip the cgroup of this layer */
	926	+ continue;
924	927	found:
925		− BUG_ON(!cg);
926	928	progs = rcu_dereference_protected(
927	929	desc->bpf.effective[atype],
928	930	lockdep_is_held(&cgroup_mutex));

kernel/bpf/core.c+1−1

@@ -971,7 +971,7 @@ pure_initcall(bpf_jit_charge_init); · 970 unmodified lines
971	971
972	972	int bpf_jit_charge_modmem(u32 size)
973	973	{
974		− if (atomic_long_add_return(size, &bpf_jit_current) > bpf_jit_limit) {
	974	+ if (atomic_long_add_return(size, &bpf_jit_current) > READ_ONCE(bpf_jit_limit)) {
975	975	if (!bpf_capable()) {
976	976	atomic_long_sub(size, &bpf_jit_current);
977	977	return -EPERM;

kernel/bpf/syscall.c+1−1

@@ -5197,7 +5197,7 @@ syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 5196 unmodified lines
5197	5197	{
5198	5198	switch (func_id) {
5199	5199	case BPF_FUNC_sys_bpf:
5200		− return &bpf_sys_bpf_proto;
	5200	+ return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto;
5201	5201	case BPF_FUNC_btf_find_by_name_kind:
5202	5202	return &bpf_btf_find_by_name_kind_proto;
5203	5203	case BPF_FUNC_sys_close:

kernel/bpf/verifier.c+7−6

@@ -6066,6 +6066,9 @@ skip_type_check: · 6065 unmodified lines
6066	6066	return -EACCES;
6067	6067	}
6068	6068	meta->mem_size = reg->var_off.value;
	6069	+ err = mark_chain_precision(env, regno);
	6070	+ if (err)
	6071	+ return err;
6069	6072	break;
6070	6073	case ARG_PTR_TO_INT:
6071	6074	case ARG_PTR_TO_LONG:
@@ -7030,8 +7033,7 @@ record_func_key(struct bpf_verifier_env env, struct bpf_call_arg_meta meta, · 958 unmodified lines
7030	7033	struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx];
7031	7034	struct bpf_reg_state regs = cur_regs(env), reg;
7032	7035	struct bpf_map *map = meta->map_ptr;
7033		− struct tnum range;
7034		− u64 val;
	7036	+ u64 val, max;
7035	7037	int err;
7036	7038
7037	7039	if (func_id != BPF_FUNC_tail_call)
@@ -7041,10 +7043,11 @@ record_func_key(struct bpf_verifier_env env, struct bpf_call_arg_meta meta, · 3 unmodified lines
7041	7043	return -EINVAL;
7042	7044	}
7043	7045
7044		− range = tnum_range(0, map->max_entries - 1);
7045	7046	reg = &regs[BPF_REG_3];
	7047	+ val = reg->var_off.value;
	7048	+ max = map->max_entries;
7046	7049
7047		− if (!register_is_const(reg) \|\| !tnum_in(range, reg->var_off)) {
	7050	+ if (!(register_is_const(reg) && val < max)) {
7048	7051	bpf_map_key_store(aux, BPF_MAP_KEY_POISON);
7049	7052	return 0;
7050	7053	}
@@ -7052,8 +7055,6 @@ record_func_key(struct bpf_verifier_env env, struct bpf_call_arg_meta meta, · 1 unmodified line
7052	7055	err = mark_chain_precision(env, BPF_REG_3);
7053	7056	if (err)
7054	7057	return err;
7055		−
7056		− val = reg->var_off.value;
7057	7058	if (bpf_map_key_unseen(aux))
7058	7059	bpf_map_key_store(aux, val);
7059	7060	else if (!bpf_map_key_poisoned(aux) &&

net/core/skmsg.c+2−2

@@ -461,7 +461,7 @@ int sk_msg_recvmsg(struct sock sk, struct sk_psock psock, struct msghdr *msg, · 460 unmodified lines
461	461
462	462	if (copied == len)
463	463	break;
464		− } while (!sg_is_last(sge));
	464	+ } while ((i != msg_rx->sg.end) && !sg_is_last(sge));
465	465
466	466	if (unlikely(peek)) {
467	467	msg_rx = sk_psock_next_msg(psock, msg_rx);
@@ -471,7 +471,7 @@ int sk_msg_recvmsg(struct sock sk, struct sk_psock psock, struct msghdr *msg, · 3 unmodified lines
471	471	}
472	472
473	473	msg_rx->sg.start = i;
474		− if (!sge->length && sg_is_last(sge)) {
	474	+ if (!sge->length && (i == msg_rx->sg.end \|\| sg_is_last(sge))) {
475	475	msg_rx = sk_psock_dequeue_msg(psock);
476	476	kfree_sk_msg(msg_rx);
477	477	}

net/ipv4/ip_gre.c+1−1

@@ -609,7 +609,7 @@ static int gre_fill_metadata_dst(struct net_device dev, struct sk_buff skb) · 608 unmodified lines
609	609	ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src,
610	610	tunnel_id_to_key32(key->tun_id),
611	611	key->tos & ~INET_ECN_MASK, dev_net(dev), 0,
612		− skb->mark, skb_get_hash(skb));
	612	+ skb->mark, skb_get_hash(skb), key->flow_flags);
613	613	rt = ip_route_output_key(dev_net(dev), &fl4);
614	614	if (IS_ERR(rt))
615	615	return PTR_ERR(rt);

net/ipv4/ip_tunnel.c+4−3

@@ -295,7 +295,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev) · 294 unmodified lines
295	295	ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
296	296	iph->saddr, tunnel->parms.o_key,
297	297	RT_TOS(iph->tos), dev_net(dev),
298		− tunnel->parms.link, tunnel->fwmark, 0);
	298	+ tunnel->parms.link, tunnel->fwmark, 0, 0);
299	299	rt = ip_route_output_key(tunnel->net, &fl4);
300	300
301	301	if (!IS_ERR(rt)) {
@@ -570,7 +570,8 @@ void ip_md_tunnel_xmit(struct sk_buff skb, struct net_device dev, · 268 unmodified lines
570	570	}
571	571	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
572	572	tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
573		− dev_net(dev), 0, skb->mark, skb_get_hash(skb));
	573	+ dev_net(dev), 0, skb->mark, skb_get_hash(skb),
	574	+ key->flow_flags);
574	575	if (tunnel->encap.type != TUNNEL_ENCAP_NONE)
575	576	goto tx_error;
576	577
@@ -729,7 +730,7 @@ void ip_tunnel_xmit(struct sk_buff skb, struct net_device dev, · 152 unmodified lines
729	730	ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr,
730	731	tunnel->parms.o_key, RT_TOS(tos),
731	732	dev_net(dev), tunnel->parms.link,
732		− tunnel->fwmark, skb_get_hash(skb));
	733	+ tunnel->fwmark, skb_get_hash(skb), 0);
733	734
734	735	if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)
735	736	goto tx_error;

net/xdp/xsk_buff_pool.c+10−6

@@ -379,6 +379,16 @@ static void xp_check_dma_contiguity(struct xsk_dma_map *dma_map) · 378 unmodified lines
379	379
380	380	static int xp_init_dma_info(struct xsk_buff_pool pool, struct xsk_dma_map dma_map)
381	381	{
	382	+ if (!pool->unaligned) {
	383	+ u32 i;
	384	+
	385	+ for (i = 0; i < pool->heads_cnt; i++) {
	386	+ struct xdp_buff_xsk *xskb = &pool->heads[i];
	387	+
	388	+ xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr);
	389	+ }
	390	+ }
	391	+
382	392	pool->dma_pages = kvcalloc(dma_map->dma_pages_cnt, sizeof(*pool->dma_pages), GFP_KERNEL);
383	393	if (!pool->dma_pages)
384	394	return -ENOMEM;
@@ -428,12 +438,6 @@ int xp_dma_map(struct xsk_buff_pool pool, struct device dev, · 43 unmodified lines
428	438
429	439	if (pool->unaligned)
430	440	xp_check_dma_contiguity(dma_map);
431		− else
432		− for (i = 0; i < pool->heads_cnt; i++) {
433		− struct xdp_buff_xsk *xskb = &pool->heads[i];
434		−
435		− xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr);
436		− }
437	441
438	442	err = xp_init_dma_info(pool, dma_map);
439	443	if (err) {

tools/testing/selftests/bpf/DENYLIST.s390x+1−0

@@ -65,3 +65,4 @@ send_signal # intermittently fails to receive signa · 64 unmodified lines
65	65	select_reuseport # intermittently fails on new s390x setup
66	66	xdp_synproxy # JIT does not support calling kernel function (kfunc)
67	67	unpriv_bpf_disabled # fentry
	68	+lru_bug # prog 'printk': failed to auto-attach: -524

tools/testing/selftests/bpf/verifier/precise.c+25−0

@@ -192,3 +192,28 @@ · 191 unmodified lines
192	192	.result = VERBOSE_ACCEPT,
193	193	.retval = -1,
194	194	},
	195	+{
	196	+ "precise: mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO",
	197	+ .insns = {
	198	+ BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, offsetof(struct xdp_md, ingress_ifindex)),
	199	+ BPF_LD_MAP_FD(BPF_REG_6, 0),
	200	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
	201	+ BPF_MOV64_IMM(BPF_REG_2, 1),
	202	+ BPF_MOV64_IMM(BPF_REG_3, 0),
	203	+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 0, 1),
	204	+ BPF_MOV64_IMM(BPF_REG_2, 0x1000),
	205	+ BPF_RAW_INSN(BPF_JMP \| BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve),
	206	+ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
	207	+ BPF_EXIT_INSN(),
	208	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
	209	+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 42),
	210	+ BPF_RAW_INSN(BPF_JMP \| BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit),
	211	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	212	+ BPF_EXIT_INSN(),
	213	+ },
	214	+ .fixup_map_ringbuf = { 1 },
	215	+ .prog_type = BPF_PROG_TYPE_XDP,
	216	+ .flags = BPF_F_TEST_STATE_FREQ,
	217	+ .errstr = "invalid access to memory, mem_size=1 off=42 size=8",
	218	+ .result = REJECT,
	219	+},