Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel borkmann says: ==================== The following pull-request contains BPF updates for your *net* tree. We've added 11 non-merge commits during the last 14 day(s) which contain a total of 13 files changed, 61 insertions(+), 24 deletions(-). The main changes are: 1) Fix BPF verifier's precision tracking around BPF ring buffer, from Kumar Kartikeya Dwivedi. 2) Fix regression in tunnel key infra when passing FLOWI_FLAG_ANYSRC, from Eyal Birger. 3) Fix insufficient permissions for bpf_sys_bpf() helper, from YiFei Zhu. 4) Fix splat from hitting BUG when purging effective cgroup programs, from Pu Lehui. 5) Fix range tracking for array poke descriptors, from Daniel Borkmann. 6) Fix corrupted packets for XDP_SHARED_UMEM in aligned mode, from Magnus Karlsson. 7) Fix NULL pointer splat in BPF sockmap sk_msg_recvmsg(), from Liu Jian. 8) Add READ_ONCE() to bpf_jit_limit when reading from sysctl, from Kuniyuki Iwashima. 9) Add BPF selftest lru_bug check to s390x deny list, from Daniel Müller. ====================

David S. Miller committed 4 years ago

Commit 2e085ec2 parents 4ba9d38 a65718213 files · +61 −24Browse files

Unified · Split

13 files

drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +2 −1
include/net/ip_tunnels.h +3 −1
include/uapi/linux/bpf.h +1 −1
kernel/bpf/cgroup.c +3 −1
kernel/bpf/core.c +1 −1
kernel/bpf/syscall.c +1 −1
kernel/bpf/verifier.c +7 −6
net/core/skmsg.c +2 −2
net/ipv4/ip_gre.c +1 −1
net/ipv4/ip_tunnel.c +4 −3
net/xdp/xsk_buff_pool.c +10 −6
tools/testing/selftests/bpf/DENYLIST.s390x +1 −0
tools/testing/selftests/bpf/verifier/precise.c +25 −0

drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c+2−1

@@ -423,7 +423,8 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev, · 422 unmodified lines
423		423
424	parms = mlxsw_sp_ipip_netdev_parms4(to_dev);	424	parms = mlxsw_sp_ipip_netdev_parms4(to_dev);
425	ip_tunnel_init_flow(&fl4, parms.iph.protocol, daddrp, saddrp,	425	ip_tunnel_init_flow(&fl4, parms.iph.protocol, daddrp, saddrp,
426	0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0);	426	0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0,
		427	0);
427		428
428	rt = ip_route_output_key(tun->net, &fl4);	429	rt = ip_route_output_key(tun->net, &fl4);
429	if (IS_ERR(rt))	430	if (IS_ERR(rt))

include/net/ip_tunnels.h+3−1

 				       __be32 daddr, __be32 saddr,
 				       __be32 key, __u8 tos,
 				       struct net *net, int oif,
-				       __u32 mark, __u32 tun_inner_hash)
+				       __u32 mark, __u32 tun_inner_hash,
+				       __u8 flow_flags)
 {
 	memset(fl4, 0, sizeof(*fl4));
 	fl4->fl4_gre_key = key;
 	fl4->flowi4_mark = mark;
 	fl4->flowi4_multipath_hash = tun_inner_hash;
+	fl4->flowi4_flags = flow_flags;
 }
 int ip_tunnel_init(struct net_device *dev);

include/uapi/linux/bpf.h+1−1

@@ -79,7 +79,7 @@ struct bpf_insn { · 78 unmodified lines
79	/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry */	79	/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry */
80	struct bpf_lpm_trie_key {	80	struct bpf_lpm_trie_key {
81	__u32 prefixlen; /* up to 32 for AF_INET, 128 for AF_INET6 */	81	__u32 prefixlen; /* up to 32 for AF_INET, 128 for AF_INET6 */
82	__u8 data[]; /* Arbitrary size */	82	__u8 data[0]; /* Arbitrary size */
83	};	83	};
84		84
85	struct bpf_cgroup_storage_key {	85	struct bpf_cgroup_storage_key {

kernel/bpf/cgroup.c+3−1

 				pos++;
 			}
 		}
+		/* no link or prog match, skip the cgroup of this layer */
+		continue;
 found:
-		BUG_ON(!cg);
 		progs = rcu_dereference_protected(
 				desc->bpf.effective[atype],
 				lockdep_is_held(&cgroup_mutex));

kernel/bpf/core.c+1−1

@@ -971,7 +971,7 @@ pure_initcall(bpf_jit_charge_init); · 970 unmodified lines
971		971
972	int bpf_jit_charge_modmem(u32 size)	972	int bpf_jit_charge_modmem(u32 size)
973	{	973	{
974	if (atomic_long_add_return(size, &bpf_jit_current) > bpf_jit_limit) {	974	if (atomic_long_add_return(size, &bpf_jit_current) > READ_ONCE(bpf_jit_limit)) {
975	if (!bpf_capable()) {	975	if (!bpf_capable()) {
976	atomic_long_sub(size, &bpf_jit_current);	976	atomic_long_sub(size, &bpf_jit_current);
977	return -EPERM;	977	return -EPERM;

kernel/bpf/syscall.c+1−1

@@ -5197,7 +5197,7 @@ syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 5196 unmodified lines
5197	{	5197	{
5198	switch (func_id) {	5198	switch (func_id) {
5199	case BPF_FUNC_sys_bpf:	5199	case BPF_FUNC_sys_bpf:
5200	return &bpf_sys_bpf_proto;	5200	return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto;
5201	case BPF_FUNC_btf_find_by_name_kind:	5201	case BPF_FUNC_btf_find_by_name_kind:
5202	return &bpf_btf_find_by_name_kind_proto;	5202	return &bpf_btf_find_by_name_kind_proto;
5203	case BPF_FUNC_sys_close:	5203	case BPF_FUNC_sys_close:

kernel/bpf/verifier.c+7−6

 			return -EACCES;
 		}
 		meta->mem_size = reg->var_off.value;
+		err = mark_chain_precision(env, regno);
+		if (err)
+			return err;
 		break;
 	case ARG_PTR_TO_INT:
 	case ARG_PTR_TO_LONG:
 	struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx];
 	struct bpf_reg_state *regs = cur_regs(env), *reg;
 	struct bpf_map *map = meta->map_ptr;
-	struct tnum range;
+	u64 val, max;
-	u64 val;
 	int err;
 	if (func_id != BPF_FUNC_tail_call)
 		return -EINVAL;
 	}
-	range = tnum_range(0, map->max_entries - 1);
 	reg = &regs[BPF_REG_3];
+	val = reg->var_off.value;
+	max = map->max_entries;
-	if (!register_is_const(reg) || !tnum_in(range, reg->var_off)) {
+	if (!(register_is_const(reg) && val < max)) {
 		bpf_map_key_store(aux, BPF_MAP_KEY_POISON);
 		return 0;
 	}
 	err = mark_chain_precision(env, BPF_REG_3);
 	if (err)
 		return err;
-	val = reg->var_off.value;
 	if (bpf_map_key_unseen(aux))
 		bpf_map_key_store(aux, val);
 	else if (!bpf_map_key_poisoned(aux) &&

net/core/skmsg.c+2−2

@@ -461,7 +461,7 @@ int sk_msg_recvmsg(struct sock sk, struct sk_psock psock, struct msghdr *msg, · 460 unmodified lines
461		461
462	if (copied == len)	462	if (copied == len)
463	break;	463	break;
464	} while (!sg_is_last(sge));	464	} while ((i != msg_rx->sg.end) && !sg_is_last(sge));
465		465
466	if (unlikely(peek)) {	466	if (unlikely(peek)) {
467	msg_rx = sk_psock_next_msg(psock, msg_rx);	467	msg_rx = sk_psock_next_msg(psock, msg_rx);
@@ -471,7 +471,7 @@ int sk_msg_recvmsg(struct sock sk, struct sk_psock psock, struct msghdr *msg, · 3 unmodified lines
471	}	471	}
472		472
473	msg_rx->sg.start = i;	473	msg_rx->sg.start = i;
474	if (!sge->length && sg_is_last(sge)) {	474	if (!sge->length && (i == msg_rx->sg.end \|\| sg_is_last(sge))) {
475	msg_rx = sk_psock_dequeue_msg(psock);	475	msg_rx = sk_psock_dequeue_msg(psock);
476	kfree_sk_msg(msg_rx);	476	kfree_sk_msg(msg_rx);
477	}	477	}

net/ipv4/ip_gre.c+1−1

@@ -609,7 +609,7 @@ static int gre_fill_metadata_dst(struct net_device dev, struct sk_buff skb) · 608 unmodified lines
609	ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src,	609	ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src,
610	tunnel_id_to_key32(key->tun_id),	610	tunnel_id_to_key32(key->tun_id),
611	key->tos & ~INET_ECN_MASK, dev_net(dev), 0,	611	key->tos & ~INET_ECN_MASK, dev_net(dev), 0,
612	skb->mark, skb_get_hash(skb));	612	skb->mark, skb_get_hash(skb), key->flow_flags);
613	rt = ip_route_output_key(dev_net(dev), &fl4);	613	rt = ip_route_output_key(dev_net(dev), &fl4);
614	if (IS_ERR(rt))	614	if (IS_ERR(rt))
615	return PTR_ERR(rt);	615	return PTR_ERR(rt);

net/ipv4/ip_tunnel.c+4−3

 		ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr,
 				    iph->saddr, tunnel->parms.o_key,
 				    RT_TOS(iph->tos), dev_net(dev),
-				    tunnel->parms.link, tunnel->fwmark, 0);
+				    tunnel->parms.link, tunnel->fwmark, 0, 0);
 		rt = ip_route_output_key(tunnel->net, &fl4);
 		if (!IS_ERR(rt)) {
 	}
 	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
 			    tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
-			    dev_net(dev), 0, skb->mark, skb_get_hash(skb));
+			    dev_net(dev), 0, skb->mark, skb_get_hash(skb),
+			    key->flow_flags);
 	if (tunnel->encap.type != TUNNEL_ENCAP_NONE)
 		goto tx_error;
 	ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr,
 			    tunnel->parms.o_key, RT_TOS(tos),
 			    dev_net(dev), tunnel->parms.link,
-			    tunnel->fwmark, skb_get_hash(skb));
+			    tunnel->fwmark, skb_get_hash(skb), 0);
 	if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)
 		goto tx_error;

net/xdp/xsk_buff_pool.c+10−6

 static int xp_init_dma_info(struct xsk_buff_pool *pool, struct xsk_dma_map *dma_map)
 {
+	if (!pool->unaligned) {
+		u32 i;
+		for (i = 0; i < pool->heads_cnt; i++) {
+			struct xdp_buff_xsk *xskb = &pool->heads[i];
+			xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr);
+		}
+	}
 	pool->dma_pages = kvcalloc(dma_map->dma_pages_cnt, sizeof(*pool->dma_pages), GFP_KERNEL);
 	if (!pool->dma_pages)
 		return -ENOMEM;
 	if (pool->unaligned)
 		xp_check_dma_contiguity(dma_map);
-	else
-		for (i = 0; i < pool->heads_cnt; i++) {
-			struct xdp_buff_xsk *xskb = &pool->heads[i];
-			xp_init_xskb_dma(xskb, pool, dma_map->dma_pages, xskb->orig_addr);
-		}
 	err = xp_init_dma_info(pool, dma_map);
 	if (err) {

tools/testing/selftests/bpf/DENYLIST.s390x+1−0

@@ -65,3 +65,4 @@ send_signal # intermittently fails to receive signa · 64 unmodified lines
65	select_reuseport # intermittently fails on new s390x setup	65	select_reuseport # intermittently fails on new s390x setup
66	xdp_synproxy # JIT does not support calling kernel function (kfunc)	66	xdp_synproxy # JIT does not support calling kernel function (kfunc)
67	unpriv_bpf_disabled # fentry	67	unpriv_bpf_disabled # fentry
		68	lru_bug # prog 'printk': failed to auto-attach: -524

tools/testing/selftests/bpf/verifier/precise.c+25−0

@@ -192,3 +192,28 @@ · 191 unmodified lines
192	.result = VERBOSE_ACCEPT,	192	.result = VERBOSE_ACCEPT,
193	.retval = -1,	193	.retval = -1,
194	},	194	},
		195	{
		196	"precise: mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO",
		197	.insns = {
		198	BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, offsetof(struct xdp_md, ingress_ifindex)),
		199	BPF_LD_MAP_FD(BPF_REG_6, 0),
		200	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
		201	BPF_MOV64_IMM(BPF_REG_2, 1),
		202	BPF_MOV64_IMM(BPF_REG_3, 0),
		203	BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 0, 1),
		204	BPF_MOV64_IMM(BPF_REG_2, 0x1000),
		205	BPF_RAW_INSN(BPF_JMP \| BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve),
		206	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
		207	BPF_EXIT_INSN(),
		208	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
		209	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 42),
		210	BPF_RAW_INSN(BPF_JMP \| BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit),
		211	BPF_MOV64_IMM(BPF_REG_0, 0),
		212	BPF_EXIT_INSN(),
		213	},
		214	.fixup_map_ringbuf = { 1 },
		215	.prog_type = BPF_PROG_TYPE_XDP,
		216	.flags = BPF_F_TEST_STATE_FREQ,
		217	.errstr = "invalid access to memory, mem_size=1 off=42 size=8",
		218	.result = REJECT,
		219	},