Pull BPF fixes from Daniel Borkmann: - Initialize task local storage before fork bails out to free the task (Jann Horn) - Fix insn_aux_data leak on verifier error path (KaFai Wan) - Reject BPF inode storage map creation when BPF LSM is uninitialized (Matt Bobrowski) - Mask pseudo pointer values in verifier logs when pointer leaks are not allowed (Nuoqi Gui) - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta) - Reject a skb-modifying SK_SKB stream parser since the latter is only meant to measure the next message (Sechang Lim) - Fix bpf_refcount_acquire to reject refcounted allocation arguments with a non-zero fixed offset (Yiyang Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Prefer dirty packs for eBPF allocations bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Skip redundant IBPB in pack allocator bpf: Restrict JIT predictor flush to cBPF x86/bugs: Enable IBPB flush on BPF JIT allocation bpf: Support for hardening against JIT spraying bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized bpf,fork: wipe ->bpf_storage before bailouts that access it bpf: Fix insn_aux_data leak on verifier err_free_env path selftests/bpf: Cover pseudo-BTF ksym log masking bpf: Mask pseudo pointer values in verifier logs selftests/bpf: Cover refcount acquire node offsets bpf: Reject offset refcount acquire arguments selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser bpf, sockmap: reject a packet-modifying SK_SKB stream parser selftests/bpf: don't modify the skb in the strparser parser prog
Showing the changes to include/linux (2 of 23 files). Show all
Unified · Split
| @@ -14,6 +14,8 @@ · 13 unmodified lines | ||
| 14 | 14 | |
| 15 | 15 | #ifdef CONFIG_BPF_LSM |
| 16 | 16 | |
| 17 | +extern bool bpf_lsm_initialized __ro_after_init; | |
| 18 | + | |
| 17 | 19 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ |
| 18 | 20 | RET bpf_lsm_##NAME(__VA_ARGS__); |
| 19 | 21 | #include <linux/lsm_hook_defs.h> |
| @@ -56,6 +58,8 @@ bool bpf_lsm_hook_returns_errno(u32 btf_id); · 36 unmodified lines | ||
| 56 | 58 | |
| 57 | 59 | #else /* !CONFIG_BPF_LSM */ |
| 58 | 60 | |
| 61 | +#define bpf_lsm_initialized false | |
| 62 | + | |
| 59 | 63 | static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) |
| 60 | 64 | { |
| 61 | 65 | return false; |
| @@ -21,6 +21,7 @@ · 20 unmodified lines | ||
| 21 | 21 | #include <linux/if_vlan.h> |
| 22 | 22 | #include <linux/vmalloc.h> |
| 23 | 23 | #include <linux/sockptr.h> |
| 24 | +#include <linux/static_call.h> | |
| 24 | 25 | #include <linux/u64_stats_sync.h> |
| 25 | 26 | |
| 26 | 27 | #include <net/sch_generic.h> |
| @@ -1314,6 +1315,15 @@ extern long bpf_jit_limit_max; · 1287 unmodified lines | ||
| 1314 | 1315 | |
| 1315 | 1316 | typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); |
| 1316 | 1317 | |
| 1318 | +/* | |
| 1319 | + * Flush the indirect branch predictors before reusing JIT memory, so that | |
| 1320 | + * indirect jumps into a newly written program don't reuse predictions left | |
| 1321 | + * behind by an old program that occupied the same space. | |
| 1322 | + */ | |
| 1323 | +void bpf_arch_pred_flush(void); | |
| 1324 | +DECLARE_STATIC_CALL(bpf_arch_pred_flush, bpf_arch_pred_flush); | |
| 1325 | +DECLARE_STATIC_KEY_FALSE(bpf_pred_flush_enabled); | |
| 1326 | + | |
| 1317 | 1327 | void bpf_jit_fill_hole_with_zero(void *area, unsigned int size); |
| 1318 | 1328 | |
| 1319 | 1329 | struct bpf_binary_header * |
| @@ -1328,7 +1338,7 @@ void bpf_jit_free(struct bpf_prog *fp); · 8 unmodified lines | ||
| 1328 | 1338 | struct bpf_binary_header * |
| 1329 | 1339 | bpf_jit_binary_pack_hdr(const struct bpf_prog *fp); |
| 1330 | 1340 | |
| 1331 | −void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns); | |
| 1341 | +void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic); | |
| 1332 | 1342 | void bpf_prog_pack_free(void *ptr, u32 size); |
| 1333 | 1343 | |
| 1334 | 1344 | static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp) |
| @@ -1342,7 +1352,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image, · 7 unmodified lines | ||
| 1342 | 1352 | unsigned int alignment, |
| 1343 | 1353 | struct bpf_binary_header **rw_hdr, |
| 1344 | 1354 | u8 **rw_image, |
| 1345 | − bpf_jit_fill_hole_t bpf_fill_ill_insns); | |
| 1355 | + bpf_jit_fill_hole_t bpf_fill_ill_insns, | |
| 1356 | + bool was_classic); | |
| 1346 | 1357 | int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header, |
| 1347 | 1358 | struct bpf_binary_header *rw_header); |
| 1348 | 1359 | void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header, |