Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel borkmann says: ==================== The following pull-request contains BPF updates for your *net* tree. We've added 11 non-merge commits during the last 14 day(s) which contain a total of 13 files changed, 61 insertions(+), 24 deletions(-). The main changes are: 1) Fix BPF verifier's precision tracking around BPF ring buffer, from Kumar Kartikeya Dwivedi. 2) Fix regression in tunnel key infra when passing FLOWI_FLAG_ANYSRC, from Eyal Birger. 3) Fix insufficient permissions for bpf_sys_bpf() helper, from YiFei Zhu. 4) Fix splat from hitting BUG when purging effective cgroup programs, from Pu Lehui. 5) Fix range tracking for array poke descriptors, from Daniel Borkmann. 6) Fix corrupted packets for XDP_SHARED_UMEM in aligned mode, from Magnus Karlsson. 7) Fix NULL pointer splat in BPF sockmap sk_msg_recvmsg(), from Liu Jian. 8) Add READ_ONCE() to bpf_jit_limit when reading from sysctl, from Kuniyuki Iwashima. 9) Add BPF selftest lru_bug check to s390x deny list, from Daniel Müller. ====================

David S. Miller committed 4 years ago

Commit 2e085ec2 parents 4ba9d38 a65718213 files · +61 −24Browse files

Showing the changes to kernel (4 of 13 files). Show all

Unified · Split

4 files

kernel/bpf/cgroup.c +3 −1
kernel/bpf/core.c +1 −1
kernel/bpf/syscall.c +1 −1
kernel/bpf/verifier.c +7 −6

kernel/bpf/cgroup.c+3−1

 				pos++;
 			}
 		}
+		/* no link or prog match, skip the cgroup of this layer */
+		continue;
 found:
-		BUG_ON(!cg);
 		progs = rcu_dereference_protected(
 				desc->bpf.effective[atype],
 				lockdep_is_held(&cgroup_mutex));

kernel/bpf/core.c+1−1

@@ -971,7 +971,7 @@ pure_initcall(bpf_jit_charge_init); · 970 unmodified lines
971		971
972	int bpf_jit_charge_modmem(u32 size)	972	int bpf_jit_charge_modmem(u32 size)
973	{	973	{
974	if (atomic_long_add_return(size, &bpf_jit_current) > bpf_jit_limit) {	974	if (atomic_long_add_return(size, &bpf_jit_current) > READ_ONCE(bpf_jit_limit)) {
975	if (!bpf_capable()) {	975	if (!bpf_capable()) {
976	atomic_long_sub(size, &bpf_jit_current);	976	atomic_long_sub(size, &bpf_jit_current);
977	return -EPERM;	977	return -EPERM;

kernel/bpf/syscall.c+1−1

@@ -5197,7 +5197,7 @@ syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 5196 unmodified lines
5197	{	5197	{
5198	switch (func_id) {	5198	switch (func_id) {
5199	case BPF_FUNC_sys_bpf:	5199	case BPF_FUNC_sys_bpf:
5200	return &bpf_sys_bpf_proto;	5200	return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto;
5201	case BPF_FUNC_btf_find_by_name_kind:	5201	case BPF_FUNC_btf_find_by_name_kind:
5202	return &bpf_btf_find_by_name_kind_proto;	5202	return &bpf_btf_find_by_name_kind_proto;
5203	case BPF_FUNC_sys_close:	5203	case BPF_FUNC_sys_close:

kernel/bpf/verifier.c+7−6

 			return -EACCES;
 		}
 		meta->mem_size = reg->var_off.value;
+		err = mark_chain_precision(env, regno);
+		if (err)
+			return err;
 		break;
 	case ARG_PTR_TO_INT:
 	case ARG_PTR_TO_LONG:
 	struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx];
 	struct bpf_reg_state *regs = cur_regs(env), *reg;
 	struct bpf_map *map = meta->map_ptr;
-	struct tnum range;
+	u64 val, max;
-	u64 val;
 	int err;
 	if (func_id != BPF_FUNC_tail_call)
 		return -EINVAL;
 	}
-	range = tnum_range(0, map->max_entries - 1);
 	reg = &regs[BPF_REG_3];
+	val = reg->var_off.value;
+	max = map->max_entries;
-	if (!register_is_const(reg) || !tnum_in(range, reg->var_off)) {
+	if (!(register_is_const(reg) && val < max)) {
 		bpf_map_key_store(aux, BPF_MAP_KEY_POISON);
 		return 0;
 	}
 	err = mark_chain_precision(env, BPF_REG_3);
 	if (err)
 		return err;
-	val = reg->var_off.value;
 	if (bpf_map_key_unseen(aux))
 		bpf_map_key_store(aux, val);
 	else if (!bpf_map_key_poisoned(aux) &&