History

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull BPF fixes from Daniel Borkmann: - Initialize task local storage before fork bails out to free the task (Jann Horn) - Fix insn_aux_data leak on verifier error path (KaFai Wan) - Reject BPF inode storage map creation when BPF LSM is uninitialized (Matt Bobrowski) - Mask pseudo pointer values in verifier logs when pointer leaks are not allowed (Nuoqi Gui) - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta) - Reject a skb-modifying SK_SKB stream parser since the latter is only meant to measure the next message (Sechang Lim) - Fix bpf_refcount_acquire to reject refcounted allocation arguments with a non-zero fixed offset (Yiyang Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Prefer dirty packs for eBPF allocations bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Skip redundant IBPB in pack allocator bpf: Restrict JIT predictor flush to cBPF x86/bugs: Enable IBPB flush on BPF JIT allocation bpf: Support for hardening against JIT spraying bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized bpf,fork: wipe ->bpf_storage before bailouts that access it bpf: Fix insn_aux_data leak on verifier err_free_env path selftests/bpf: Cover pseudo-BTF ksym log masking bpf: Mask pseudo pointer values in verifier logs selftests/bpf: Cover refcount acquire node offsets bpf: Reject offset refcount acquire arguments selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser bpf, sockmap: reject a packet-modifying SK_SKB stream parser selftests/bpf: don't modify the skb in the strparser parser prog

Linus Torvalds committed 4 months ago

Commit 51512e22 parents 826eec5 b72e29e23 files · +297 −62Browse files

Showing the changes to include/linux (2 of 23 files). Show all

Unified · Split

2 files
  1. include/linux/bpf_lsm.h +4 −0
  2. include/linux/filter.h +13 −2
include/linux/bpf_lsm.h+4−0
@@ -14,6 +14,8 @@ · 13 unmodified lines
14 14
15#ifdef CONFIG_BPF_LSM15#ifdef CONFIG_BPF_LSM
16 16
17extern bool bpf_lsm_initialized __ro_after_init;
18
17#define LSM_HOOK(RET, DEFAULT, NAME, ...) \19#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
18 RET bpf_lsm_##NAME(__VA_ARGS__);20 RET bpf_lsm_##NAME(__VA_ARGS__);
19#include <linux/lsm_hook_defs.h>21#include <linux/lsm_hook_defs.h>
@@ -56,6 +58,8 @@ bool bpf_lsm_hook_returns_errno(u32 btf_id); · 36 unmodified lines
56 58
57#else /* !CONFIG_BPF_LSM */59#else /* !CONFIG_BPF_LSM */
58 60
61#define bpf_lsm_initialized false
62
59static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)63static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)
60{64{
61 return false;65 return false;
include/linux/filter.h+13−2
@@ -21,6 +21,7 @@ · 20 unmodified lines
21#include <linux/if_vlan.h>21#include <linux/if_vlan.h>
22#include <linux/vmalloc.h>22#include <linux/vmalloc.h>
23#include <linux/sockptr.h>23#include <linux/sockptr.h>
24#include <linux/static_call.h>
24#include <linux/u64_stats_sync.h>25#include <linux/u64_stats_sync.h>
25 26
26#include <net/sch_generic.h>27#include <net/sch_generic.h>
@@ -1314,6 +1315,15 @@ extern long bpf_jit_limit_max; · 1287 unmodified lines
1314 1315
1315typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);1316typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
1316 1317
1318/*
1319 * Flush the indirect branch predictors before reusing JIT memory, so that
1320 * indirect jumps into a newly written program don't reuse predictions left
1321 * behind by an old program that occupied the same space.
1322 */
1323void bpf_arch_pred_flush(void);
1324DECLARE_STATIC_CALL(bpf_arch_pred_flush, bpf_arch_pred_flush);
1325DECLARE_STATIC_KEY_FALSE(bpf_pred_flush_enabled);
1326
1317void bpf_jit_fill_hole_with_zero(void *area, unsigned int size);1327void bpf_jit_fill_hole_with_zero(void *area, unsigned int size);
1318 1328
1319struct bpf_binary_header *1329struct bpf_binary_header *
@@ -1328,7 +1338,7 @@ void bpf_jit_free(struct bpf_prog *fp); · 8 unmodified lines
1328struct bpf_binary_header *1338struct bpf_binary_header *
1329bpf_jit_binary_pack_hdr(const struct bpf_prog *fp);1339bpf_jit_binary_pack_hdr(const struct bpf_prog *fp);
1330 1340
1331void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns);1341void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic);
1332void bpf_prog_pack_free(void *ptr, u32 size);1342void bpf_prog_pack_free(void *ptr, u32 size);
1333 1343
1334static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp)1344static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp)
@@ -1342,7 +1352,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image, · 7 unmodified lines
1342 unsigned int alignment,1352 unsigned int alignment,
1343 struct bpf_binary_header **rw_hdr,1353 struct bpf_binary_header **rw_hdr,
1344 u8 **rw_image,1354 u8 **rw_image,
1345 bpf_jit_fill_hole_t bpf_fill_ill_insns);1355 bpf_jit_fill_hole_t bpf_fill_ill_insns,
1356 bool was_classic);
1346int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,1357int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,
1347 struct bpf_binary_header *rw_header);1358 struct bpf_binary_header *rw_header);
1348void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header,1359void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header,

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t