Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel borkmann says: ==================== The following pull-request contains BPF updates for your *net* tree. We've added 11 non-merge commits during the last 14 day(s) which contain a total of 13 files changed, 61 insertions(+), 24 deletions(-). The main changes are: 1) Fix BPF verifier's precision tracking around BPF ring buffer, from Kumar Kartikeya Dwivedi. 2) Fix regression in tunnel key infra when passing FLOWI_FLAG_ANYSRC, from Eyal Birger. 3) Fix insufficient permissions for bpf_sys_bpf() helper, from YiFei Zhu. 4) Fix splat from hitting BUG when purging effective cgroup programs, from Pu Lehui. 5) Fix range tracking for array poke descriptors, from Daniel Borkmann. 6) Fix corrupted packets for XDP_SHARED_UMEM in aligned mode, from Magnus Karlsson. 7) Fix NULL pointer splat in BPF sockmap sk_msg_recvmsg(), from Liu Jian. 8) Add READ_ONCE() to bpf_jit_limit when reading from sysctl, from Kuniyuki Iwashima. 9) Add BPF selftest lru_bug check to s390x deny list, from Daniel Müller. ====================

David S. Miller committed 4 years ago

Commit 2e085ec2 parents 4ba9d38 a65718213 files · +61 −24Browse files

Showing the changes to kernel (4 of 13 files). Show all

Unified · Split

4 files

kernel/bpf/cgroup.c +3 −1
kernel/bpf/core.c +1 −1
kernel/bpf/syscall.c +1 −1
kernel/bpf/verifier.c +7 −6

kernel/bpf/cgroup.c+3−1

@@ -921,8 +921,10 @@ static void purge_effective_progs(struct cgroup cgrp, struct bpf_prog prog, · 920 unmodified lines
921	921	pos++;
922	922	}
923	923	}
	924	+
	925	+ /* no link or prog match, skip the cgroup of this layer */
	926	+ continue;
924	927	found:
925		− BUG_ON(!cg);
926	928	progs = rcu_dereference_protected(
927	929	desc->bpf.effective[atype],
928	930	lockdep_is_held(&cgroup_mutex));

kernel/bpf/core.c+1−1

@@ -971,7 +971,7 @@ pure_initcall(bpf_jit_charge_init); · 970 unmodified lines
971	971
972	972	int bpf_jit_charge_modmem(u32 size)
973	973	{
974		− if (atomic_long_add_return(size, &bpf_jit_current) > bpf_jit_limit) {
	974	+ if (atomic_long_add_return(size, &bpf_jit_current) > READ_ONCE(bpf_jit_limit)) {
975	975	if (!bpf_capable()) {
976	976	atomic_long_sub(size, &bpf_jit_current);
977	977	return -EPERM;

kernel/bpf/syscall.c+1−1

@@ -5197,7 +5197,7 @@ syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 5196 unmodified lines
5197	5197	{
5198	5198	switch (func_id) {
5199	5199	case BPF_FUNC_sys_bpf:
5200		− return &bpf_sys_bpf_proto;
	5200	+ return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto;
5201	5201	case BPF_FUNC_btf_find_by_name_kind:
5202	5202	return &bpf_btf_find_by_name_kind_proto;
5203	5203	case BPF_FUNC_sys_close:

kernel/bpf/verifier.c+7−6

@@ -6066,6 +6066,9 @@ skip_type_check: · 6065 unmodified lines
6066	6066	return -EACCES;
6067	6067	}
6068	6068	meta->mem_size = reg->var_off.value;
	6069	+ err = mark_chain_precision(env, regno);
	6070	+ if (err)
	6071	+ return err;
6069	6072	break;
6070	6073	case ARG_PTR_TO_INT:
6071	6074	case ARG_PTR_TO_LONG:
@@ -7030,8 +7033,7 @@ record_func_key(struct bpf_verifier_env env, struct bpf_call_arg_meta meta, · 958 unmodified lines
7030	7033	struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx];
7031	7034	struct bpf_reg_state regs = cur_regs(env), reg;
7032	7035	struct bpf_map *map = meta->map_ptr;
7033		− struct tnum range;
7034		− u64 val;
	7036	+ u64 val, max;
7035	7037	int err;
7036	7038
7037	7039	if (func_id != BPF_FUNC_tail_call)
@@ -7041,10 +7043,11 @@ record_func_key(struct bpf_verifier_env env, struct bpf_call_arg_meta meta, · 3 unmodified lines
7041	7043	return -EINVAL;
7042	7044	}
7043	7045
7044		− range = tnum_range(0, map->max_entries - 1);
7045	7046	reg = &regs[BPF_REG_3];
	7047	+ val = reg->var_off.value;
	7048	+ max = map->max_entries;
7046	7049
7047		− if (!register_is_const(reg) \|\| !tnum_in(range, reg->var_off)) {
	7050	+ if (!(register_is_const(reg) && val < max)) {
7048	7051	bpf_map_key_store(aux, BPF_MAP_KEY_POISON);
7049	7052	return 0;
7050	7053	}
@@ -7052,8 +7055,6 @@ record_func_key(struct bpf_verifier_env env, struct bpf_call_arg_meta meta, · 1 unmodified line
7052	7055	err = mark_chain_precision(env, BPF_REG_3);
7053	7056	if (err)
7054	7057	return err;
7055		−
7056		− val = reg->var_off.value;
7057	7058	if (bpf_map_key_unseen(aux))
7058	7059	bpf_map_key_store(aux, val);
7059	7060	else if (!bpf_map_key_poisoned(aux) &&