Pull BPF fixes from Daniel Borkmann: - Initialize task local storage before fork bails out to free the task (Jann Horn) - Fix insn_aux_data leak on verifier error path (KaFai Wan) - Reject BPF inode storage map creation when BPF LSM is uninitialized (Matt Bobrowski) - Mask pseudo pointer values in verifier logs when pointer leaks are not allowed (Nuoqi Gui) - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta) - Reject a skb-modifying SK_SKB stream parser since the latter is only meant to measure the next message (Sechang Lim) - Fix bpf_refcount_acquire to reject refcounted allocation arguments with a non-zero fixed offset (Yiyang Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Prefer dirty packs for eBPF allocations bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Skip redundant IBPB in pack allocator bpf: Restrict JIT predictor flush to cBPF x86/bugs: Enable IBPB flush on BPF JIT allocation bpf: Support for hardening against JIT spraying bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized bpf,fork: wipe ->bpf_storage before bailouts that access it bpf: Fix insn_aux_data leak on verifier err_free_env path selftests/bpf: Cover pseudo-BTF ksym log masking bpf: Mask pseudo pointer values in verifier logs selftests/bpf: Cover refcount acquire node offsets bpf: Reject offset refcount acquire arguments selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser bpf, sockmap: reject a packet-modifying SK_SKB stream parser selftests/bpf: don't modify the skb in the strparser parser prog
Showing the changes to include/linux (2 of 23 files). Show all
Unified · Split
| @@ -14,6 +14,8 @@ · 13 unmodified lines | |||
| 14 | 14 | ||
| 15 | #ifdef CONFIG_BPF_LSM | 15 | #ifdef CONFIG_BPF_LSM |
| 16 | 16 | ||
| 17 | extern bool bpf_lsm_initialized __ro_after_init; | ||
| 18 | |||
| 17 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ | 19 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ |
| 18 | RET bpf_lsm_##NAME(__VA_ARGS__); | 20 | RET bpf_lsm_##NAME(__VA_ARGS__); |
| 19 | #include <linux/lsm_hook_defs.h> | 21 | #include <linux/lsm_hook_defs.h> |
| @@ -56,6 +58,8 @@ bool bpf_lsm_hook_returns_errno(u32 btf_id); · 36 unmodified lines | |||
| 56 | 58 | ||
| 57 | #else /* !CONFIG_BPF_LSM */ | 59 | #else /* !CONFIG_BPF_LSM */ |
| 58 | 60 | ||
| 61 | #define bpf_lsm_initialized false | ||
| 62 | |||
| 59 | static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) | 63 | static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) |
| 60 | { | 64 | { |
| 61 | return false; | 65 | return false; |
| @@ -21,6 +21,7 @@ · 20 unmodified lines | |||
| 21 | #include <linux/if_vlan.h> | 21 | #include <linux/if_vlan.h> |
| 22 | #include <linux/vmalloc.h> | 22 | #include <linux/vmalloc.h> |
| 23 | #include <linux/sockptr.h> | 23 | #include <linux/sockptr.h> |
| 24 | #include <linux/static_call.h> | ||
| 24 | #include <linux/u64_stats_sync.h> | 25 | #include <linux/u64_stats_sync.h> |
| 25 | 26 | ||
| 26 | #include <net/sch_generic.h> | 27 | #include <net/sch_generic.h> |
| @@ -1314,6 +1315,15 @@ extern long bpf_jit_limit_max; · 1287 unmodified lines | |||
| 1314 | 1315 | ||
| 1315 | typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); | 1316 | typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); |
| 1316 | 1317 | ||
| 1318 | /* | ||
| 1319 | * Flush the indirect branch predictors before reusing JIT memory, so that | ||
| 1320 | * indirect jumps into a newly written program don't reuse predictions left | ||
| 1321 | * behind by an old program that occupied the same space. | ||
| 1322 | */ | ||
| 1323 | void bpf_arch_pred_flush(void); | ||
| 1324 | DECLARE_STATIC_CALL(bpf_arch_pred_flush, bpf_arch_pred_flush); | ||
| 1325 | DECLARE_STATIC_KEY_FALSE(bpf_pred_flush_enabled); | ||
| 1326 | |||
| 1317 | void bpf_jit_fill_hole_with_zero(void *area, unsigned int size); | 1327 | void bpf_jit_fill_hole_with_zero(void *area, unsigned int size); |
| 1318 | 1328 | ||
| 1319 | struct bpf_binary_header * | 1329 | struct bpf_binary_header * |
| @@ -1328,7 +1338,7 @@ void bpf_jit_free(struct bpf_prog *fp); · 8 unmodified lines | |||
| 1328 | struct bpf_binary_header * | 1338 | struct bpf_binary_header * |
| 1329 | bpf_jit_binary_pack_hdr(const struct bpf_prog *fp); | 1339 | bpf_jit_binary_pack_hdr(const struct bpf_prog *fp); |
| 1330 | 1340 | ||
| 1331 | void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns); | 1341 | void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic); |
| 1332 | void bpf_prog_pack_free(void *ptr, u32 size); | 1342 | void bpf_prog_pack_free(void *ptr, u32 size); |
| 1333 | 1343 | ||
| 1334 | static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp) | 1344 | static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp) |
| @@ -1342,7 +1352,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image, · 7 unmodified lines | |||
| 1342 | unsigned int alignment, | 1352 | unsigned int alignment, |
| 1343 | struct bpf_binary_header **rw_hdr, | 1353 | struct bpf_binary_header **rw_hdr, |
| 1344 | u8 **rw_image, | 1354 | u8 **rw_image, |
| 1345 | bpf_jit_fill_hole_t bpf_fill_ill_insns); | 1355 | bpf_jit_fill_hole_t bpf_fill_ill_insns, |
| 1356 | bool was_classic); | ||
| 1346 | int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header, | 1357 | int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header, |
| 1347 | struct bpf_binary_header *rw_header); | 1358 | struct bpf_binary_header *rw_header); |
| 1348 | void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header, | 1359 | void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header, |