Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says: ==================== pull-request: bpf 2022-04-27 We've added 5 non-merge commits during the last 20 day(s) which contain a total of 6 files changed, 34 insertions(+), 12 deletions(-). The main changes are: 1) Fix xsk sockets when rx and tx are separately bound to the same umem, also fix xsk copy mode combined with busy poll, from Maciej Fijalkowski. 2) Fix BPF tunnel/collect_md helpers with bpf_xmit lwt hook usage which triggered a crash due to invalid metadata_dst access, from Eyal Birger. 3) Fix release of page pool in XDP live packet mode, from Toke Høiland-Jørgensen. 4) Fix potential NULL pointer dereference in kretprobes, from Adam Zabrocki. (Masami & Steven preferred this small fix to be routed via bpf tree given it's follow-up fix to Masami's rethook work that went via bpf earlier, too.) * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: xsk: Fix possible crash when multiple sockets are created kprobes: Fix KRETPROBES when CONFIG_KRETPROBE_ON_RETHOOK is set bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook bpf: Fix release of page_pool in BPF_PROG_RUN in test runner xsk: Fix l2fwd for copy mode + busy poll combo ====================

Jakub Kicinski committed 4 years ago

Commit 347cb5d2 parents 7b5148b ba3beec6 files · +34 −12Browse files

Unified · Split

6 files

include/net/xsk_buff_pool.h +1 −0
kernel/kprobes.c +1 −1
net/bpf/test_run.c +3 −2
net/core/lwt_bpf.c +3 −4
net/xdp/xsk.c +14 −1
net/xdp/xsk_buff_pool.c +12 −4

include/net/xsk_buff_pool.h+1−0

@@ -97,6 +97,7 @@ int xp_assign_dev(struct xsk_buff_pool pool, struct net_device dev, · 96 unmodified lines
97	u16 queue_id, u16 flags);	97	u16 queue_id, u16 flags);
98	int xp_assign_dev_shared(struct xsk_buff_pool pool, struct xdp_umem umem,	98	int xp_assign_dev_shared(struct xsk_buff_pool pool, struct xdp_umem umem,
99	struct net_device *dev, u16 queue_id);	99	struct net_device *dev, u16 queue_id);
		100	int xp_alloc_tx_descs(struct xsk_buff_pool pool, struct xdp_sock xs);
100	void xp_destroy(struct xsk_buff_pool *pool);	101	void xp_destroy(struct xsk_buff_pool *pool);
101	void xp_get_pool(struct xsk_buff_pool *pool);	102	void xp_get_pool(struct xsk_buff_pool *pool);
102	bool xp_put_pool(struct xsk_buff_pool *pool);	103	bool xp_put_pool(struct xsk_buff_pool *pool);

kernel/kprobes.c+1−1

@@ -2126,7 +2126,7 @@ static void kretprobe_rethook_handler(struct rethook_node rh, void data, · 2125 unmodified lines
2126	struct kprobe_ctlblk *kcb;	2126	struct kprobe_ctlblk *kcb;
2127		2127
2128	/* The data must NOT be null. This means rethook data structure is broken. */	2128	/* The data must NOT be null. This means rethook data structure is broken. */
2129	if (WARN_ON_ONCE(!data))	2129	if (WARN_ON_ONCE(!data) \|\| !rp->handler)
2130	return;	2130	return;
2131		2131
2132	__this_cpu_write(current_kprobe, &rp->kp);	2132	__this_cpu_write(current_kprobe, &rp->kp);

net/bpf/test_run.c+3−2

 	struct page_pool *pp;
 	struct xdp_frame **frames;
 	struct sk_buff **skbs;
+	struct xdp_mem_info mem;
 	u32 batch_size;
 	u32 frame_cnt;
 };
 static int xdp_test_run_setup(struct xdp_test_data *xdp, struct xdp_buff *orig_ctx)
 {
-	struct xdp_mem_info mem = {};
 	struct page_pool *pp;
 	int err = -ENOMEM;
 	struct page_pool_params pp_params = {
 	}
 	/* will copy 'mem.id' into pp->xdp_mem_id */
-	err = xdp_reg_mem_model(&mem, MEM_TYPE_PAGE_POOL, pp);
+	err = xdp_reg_mem_model(&xdp->mem, MEM_TYPE_PAGE_POOL, pp);
 	if (err)
 		goto err_mmodel;
 static void xdp_test_run_teardown(struct xdp_test_data *xdp)
 {
+	xdp_unreg_mem_model(&xdp->mem);
 	page_pool_destroy(xdp->pp);
 	kfree(xdp->frames);
 	kfree(xdp->skbs);

net/core/lwt_bpf.c+3−4

 	return dst->lwtstate->orig_output(net, sk, skb);
 }
-static int xmit_check_hhlen(struct sk_buff *skb)
+static int xmit_check_hhlen(struct sk_buff *skb, int hh_len)
 {
-	int hh_len = skb_dst(skb)->dev->hard_header_len;
 	if (skb_headroom(skb) < hh_len) {
 		int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb));
 	bpf = bpf_lwt_lwtunnel(dst->lwtstate);
 	if (bpf->xmit.prog) {
+		int hh_len = dst->dev->hard_header_len;
 		__be16 proto = skb->protocol;
 		int ret;
 			/* If the header was expanded, headroom might be too
 			 * small for L2 header to come, expand as needed.
 			 */
-			ret = xmit_check_hhlen(skb);
+			ret = xmit_check_hhlen(skb, hh_len);
 			if (unlikely(ret))
 				return ret;

net/xdp/xsk.c+14−1

 	if (sk_can_busy_loop(sk))
 		sk_busy_loop(sk, 1); /* only support non-blocking sockets */
-	if (xsk_no_wakeup(sk))
+	if (xs->zc && xsk_no_wakeup(sk))
 		return 0;
 	pool = xs->pool;
 			xp_get_pool(umem_xs->pool);
 			xs->pool = umem_xs->pool;
+			/* If underlying shared umem was created without Tx
+			 * ring, allocate Tx descs array that Tx batching API
+			 * utilizes
+			 */
+			if (xs->tx && !xs->pool->tx_descs) {
+				err = xp_alloc_tx_descs(xs->pool, xs);
+				if (err) {
+					xp_put_pool(xs->pool);
+					sockfd_put(sock);
+					goto out_unlock;
+				}
+			}
 		}
 		xdp_get_umem(umem_xs->umem);

net/xdp/xsk_buff_pool.c+12−4

 	kvfree(pool);
 }
+int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs)
+{
+	pool->tx_descs = kvcalloc(xs->tx->nentries, sizeof(*pool->tx_descs),
+				  GFP_KERNEL);
+	if (!pool->tx_descs)
+		return -ENOMEM;
+	return 0;
+}
 struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs,
 						struct xdp_umem *umem)
 {
 	if (!pool->heads)
 		goto out;
-	if (xs->tx) {
+	if (xs->tx)
-		pool->tx_descs = kcalloc(xs->tx->nentries, sizeof(*pool->tx_descs), GFP_KERNEL);
+		if (xp_alloc_tx_descs(pool, xs))
-		if (!pool->tx_descs)
 			goto out;
-	}
 	pool->chunk_mask = ~((u64)umem->chunk_size - 1);
 	pool->addrs_cnt = umem->size;

Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code