History

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull BPF fixes from Daniel Borkmann: - Initialize task local storage before fork bails out to free the task (Jann Horn) - Fix insn_aux_data leak on verifier error path (KaFai Wan) - Reject BPF inode storage map creation when BPF LSM is uninitialized (Matt Bobrowski) - Mask pseudo pointer values in verifier logs when pointer leaks are not allowed (Nuoqi Gui) - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta) - Reject a skb-modifying SK_SKB stream parser since the latter is only meant to measure the next message (Sechang Lim) - Fix bpf_refcount_acquire to reject refcounted allocation arguments with a non-zero fixed offset (Yiyang Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Prefer dirty packs for eBPF allocations bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Skip redundant IBPB in pack allocator bpf: Restrict JIT predictor flush to cBPF x86/bugs: Enable IBPB flush on BPF JIT allocation bpf: Support for hardening against JIT spraying bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized bpf,fork: wipe ->bpf_storage before bailouts that access it bpf: Fix insn_aux_data leak on verifier err_free_env path selftests/bpf: Cover pseudo-BTF ksym log masking bpf: Mask pseudo pointer values in verifier logs selftests/bpf: Cover refcount acquire node offsets bpf: Reject offset refcount acquire arguments selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser bpf, sockmap: reject a packet-modifying SK_SKB stream parser selftests/bpf: don't modify the skb in the strparser parser prog

Linus Torvalds committed 4 months ago

Commit 51512e22 parents 826eec5 b72e29e23 files · +297 −62Browse files

Showing the changes to include/linux (2 of 23 files). Show all

Unified · Split

2 files
  1. include/linux/bpf_lsm.h +4 −0
  2. include/linux/filter.h +13 −2
include/linux/bpf_lsm.h+4−0
@@ -14,6 +14,8 @@ · 13 unmodified lines
1414
1515 #ifdef CONFIG_BPF_LSM
1616
17+extern bool bpf_lsm_initialized __ro_after_init;
18+
1719 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
1820 RET bpf_lsm_##NAME(__VA_ARGS__);
1921 #include <linux/lsm_hook_defs.h>
@@ -56,6 +58,8 @@ bool bpf_lsm_hook_returns_errno(u32 btf_id); · 36 unmodified lines
5658
5759 #else /* !CONFIG_BPF_LSM */
5860
61+#define bpf_lsm_initialized false
62+
5963 static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)
6064 {
6165 return false;
include/linux/filter.h+13−2
@@ -21,6 +21,7 @@ · 20 unmodified lines
2121 #include <linux/if_vlan.h>
2222 #include <linux/vmalloc.h>
2323 #include <linux/sockptr.h>
24+#include <linux/static_call.h>
2425 #include <linux/u64_stats_sync.h>
2526
2627 #include <net/sch_generic.h>
@@ -1314,6 +1315,15 @@ extern long bpf_jit_limit_max; · 1287 unmodified lines
13141315
13151316 typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
13161317
1318+/*
1319+ * Flush the indirect branch predictors before reusing JIT memory, so that
1320+ * indirect jumps into a newly written program don't reuse predictions left
1321+ * behind by an old program that occupied the same space.
1322+ */
1323+void bpf_arch_pred_flush(void);
1324+DECLARE_STATIC_CALL(bpf_arch_pred_flush, bpf_arch_pred_flush);
1325+DECLARE_STATIC_KEY_FALSE(bpf_pred_flush_enabled);
1326+
13171327 void bpf_jit_fill_hole_with_zero(void *area, unsigned int size);
13181328
13191329 struct bpf_binary_header *
@@ -1328,7 +1338,7 @@ void bpf_jit_free(struct bpf_prog *fp); · 8 unmodified lines
13281338 struct bpf_binary_header *
13291339 bpf_jit_binary_pack_hdr(const struct bpf_prog *fp);
13301340
1331−void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns);
1341+void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic);
13321342 void bpf_prog_pack_free(void *ptr, u32 size);
13331343
13341344 static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp)
@@ -1342,7 +1352,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image, · 7 unmodified lines
13421352 unsigned int alignment,
13431353 struct bpf_binary_header **rw_hdr,
13441354 u8 **rw_image,
1345− bpf_jit_fill_hole_t bpf_fill_ill_insns);
1355+ bpf_jit_fill_hole_t bpf_fill_ill_insns,
1356+ bool was_classic);
13461357 int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,
13471358 struct bpf_binary_header *rw_header);
13481359 void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header,

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t