History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

No conflicts.

Jakub Kicinski committed 4 years ago

Commit 7cd28022 parents 0f473bb 6441998342 files · +3131 −1185Browse files

Showing the changes to kernel (6 of 342 files). Show all

Unified · Split

6 files
  1. kernel/audit.c +10 −11
  2. kernel/bpf/verifier.c +36 −17
  3. kernel/sched/wait.c +7 −0
  4. kernel/time/timer.c +9 −7
  5. kernel/trace/ftrace.c +7 −1
  6. kernel/trace/trace_events_synth.c +6 −5
kernel/audit.c+10−11
@@ -718,7 +718,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, · 717 unmodified lines
718718 {
719719 int rc = 0;
720720 struct sk_buff *skb;
721− static unsigned int failed = 0;
721+ unsigned int failed = 0;
722722
723723 /* NOTE: kauditd_thread takes care of all our locking, we just use
724724 * the netlink info passed to us (e.g. sk and portid) */
@@ -735,32 +735,30 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, · 10 unmodified lines
735735 continue;
736736 }
737737
738+retry:
738739 /* grab an extra skb reference in case of error */
739740 skb_get(skb);
740741 rc = netlink_unicast(sk, skb, portid, 0);
741742 if (rc < 0) {
742− /* fatal failure for our queue flush attempt? */
743+ /* send failed - try a few times unless fatal error */
743744 if (++failed >= retry_limit ||
744745 rc == -ECONNREFUSED || rc == -EPERM) {
745− /* yes - error processing for the queue */
746746 sk = NULL;
747747 if (err_hook)
748748 (*err_hook)(skb);
749− if (!skb_hook)
750− goto out;
751− /* keep processing with the skb_hook */
749+ if (rc == -EAGAIN)
750+ rc = 0;
751+ /* continue to drain the queue */
752752 continue;
753753 } else
754− /* no - requeue to preserve ordering */
755− skb_queue_head(queue, skb);
754+ goto retry;
756755 } else {
757− /* it worked - drop the extra reference and continue */
756+ /* skb sent - drop the extra reference and continue */
758757 consume_skb(skb);
759758 failed = 0;
760759 }
761760 }
762761
763−out:
764762 return (rc >= 0 ? 0 : rc);
765763 }
766764
@@ -1609,7 +1607,8 @@ static int __net_init audit_net_init(struct net *net) · 842 unmodified lines
16091607 audit_panic("cannot initialize netlink socket in namespace");
16101608 return -ENOMEM;
16111609 }
1612− aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
1610+ /* limit the timeout in case auditd is blocked/stopped */
1611+ aunet->sk->sk_sndtimeo = HZ / 10;
16131612
16141613 return 0;
16151614 }
kernel/bpf/verifier.c+36−17
@@ -1368,22 +1368,28 @@ static void __reg_bound_offset(struct bpf_reg_state *reg) · 1367 unmodified lines
13681368 reg->var_off = tnum_or(tnum_clear_subreg(var64_off), var32_off);
13691369 }
13701370
1371+static bool __reg32_bound_s64(s32 a)
1372+{
1373+ return a >= 0 && a <= S32_MAX;
1374+}
1375+
13711376 static void __reg_assign_32_into_64(struct bpf_reg_state *reg)
13721377 {
13731378 reg->umin_value = reg->u32_min_value;
13741379 reg->umax_value = reg->u32_max_value;
1375− /* Attempt to pull 32-bit signed bounds into 64-bit bounds
1376− * but must be positive otherwise set to worse case bounds
1377− * and refine later from tnum.
1380+
1381+ /* Attempt to pull 32-bit signed bounds into 64-bit bounds but must
1382+ * be positive otherwise set to worse case bounds and refine later
1383+ * from tnum.
13781384 */
1379− if (reg->s32_min_value >= 0 && reg->s32_max_value >= 0)
1380− reg->smax_value = reg->s32_max_value;
1381− else
1382− reg->smax_value = U32_MAX;
1383− if (reg->s32_min_value >= 0)
1385+ if (__reg32_bound_s64(reg->s32_min_value) &&
1386+ __reg32_bound_s64(reg->s32_max_value)) {
13841387 reg->smin_value = reg->s32_min_value;
1385− else
1388+ reg->smax_value = reg->s32_max_value;
1389+ } else {
13861390 reg->smin_value = 0;
1391+ reg->smax_value = U32_MAX;
1392+ }
13871393 }
13881394
13891395 static void __reg_combine_32_into_64(struct bpf_reg_state *reg)
@@ -2381,8 +2387,6 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, · 991 unmodified lines
23812387 */
23822388 if (insn->src_reg != BPF_REG_FP)
23832389 return 0;
2384− if (BPF_SIZE(insn->code) != BPF_DW)
2385− return 0;
23862390
23872391 /* dreg = *(u64 *)[fp - off] was a fill from the stack.
23882392 * that [fp - off] slot contains scalar that needs to be
@@ -2405,8 +2409,6 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, · 16 unmodified lines
24052409 /* scalars can only be spilled into stack */
24062410 if (insn->dst_reg != BPF_REG_FP)
24072411 return 0;
2408− if (BPF_SIZE(insn->code) != BPF_DW)
2409− return 0;
24102412 spi = (-insn->off - 1) / BPF_REG_SIZE;
24112413 if (spi >= 64) {
24122414 verbose(env, "BUG spi %d\n", spi);
@@ -4553,9 +4555,16 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i · 2140 unmodified lines
45534555
45544556 if (insn->imm == BPF_CMPXCHG) {
45554557 /* Check comparison of R0 with memory location */
4556− err = check_reg_arg(env, BPF_REG_0, SRC_OP);
4558+ const u32 aux_reg = BPF_REG_0;
4559+
4560+ err = check_reg_arg(env, aux_reg, SRC_OP);
45574561 if (err)
45584562 return err;
4563+
4564+ if (is_pointer_value(env, aux_reg)) {
4565+ verbose(env, "R%d leaks addr into mem\n", aux_reg);
4566+ return -EACCES;
4567+ }
45594568 }
45604569
45614570 if (is_pointer_value(env, insn->src_reg)) {
@@ -4590,13 +4599,19 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i · 28 unmodified lines
45904599 load_reg = -1;
45914600 }
45924601
4593− /* check whether we can read the memory */
4602+ /* Check whether we can read the memory, with second call for fetch
4603+ * case to simulate the register fill.
4604+ */
45944605 err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
4595− BPF_SIZE(insn->code), BPF_READ, load_reg, true);
4606+ BPF_SIZE(insn->code), BPF_READ, -1, true);
4607+ if (!err && load_reg >= 0)
4608+ err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
4609+ BPF_SIZE(insn->code), BPF_READ, load_reg,
4610+ true);
45964611 if (err)
45974612 return err;
45984613
4599− /* check whether we can write into the same memory */
4614+ /* Check whether we can write into the same memory. */
46004615 err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
46014616 BPF_SIZE(insn->code), BPF_WRITE, -1, true);
46024617 if (err)
@@ -8364,6 +8379,10 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) · 3761 unmodified lines
83648379 insn->dst_reg);
83658380 }
83668381 zext_32_to_64(dst_reg);
8382+
8383+ __update_reg_bounds(dst_reg);
8384+ __reg_deduce_bounds(dst_reg);
8385+ __reg_bound_offset(dst_reg);
83678386 }
83688387 } else {
83698388 /* case: R = imm
kernel/sched/wait.c+7−0
@@ -238,6 +238,13 @@ void __wake_up_sync(struct wait_queue_head *wq_head, unsigned int mode) · 237 unmodified lines
238238 }
239239 EXPORT_SYMBOL_GPL(__wake_up_sync); /* For internal use only */
240240
241+void __wake_up_pollfree(struct wait_queue_head *wq_head)
242+{
243+ __wake_up(wq_head, TASK_NORMAL, 0, poll_to_key(EPOLLHUP | POLLFREE));
244+ /* POLLFREE must have cleared the queue. */
245+ WARN_ON_ONCE(waitqueue_active(wq_head));
246+}
247+
241248 /*
242249 * Note: we use "set_current_state()" _after_ the wait-queue add,
243250 * because we need a memory barrier there on SMP, so that any
kernel/time/timer.c+9−7
@@ -2054,26 +2054,28 @@ unsigned long msleep_interruptible(unsigned int msecs) · 2053 unmodified lines
20542054 EXPORT_SYMBOL(msleep_interruptible);
20552055
20562056 /**
2057− * usleep_range - Sleep for an approximate time
2058− * @min: Minimum time in usecs to sleep
2059− * @max: Maximum time in usecs to sleep
2057+ * usleep_range_state - Sleep for an approximate time in a given state
2058+ * @min: Minimum time in usecs to sleep
2059+ * @max: Maximum time in usecs to sleep
2060+ * @state: State of the current task that will be while sleeping
20602061 *
20612062 * In non-atomic context where the exact wakeup time is flexible, use
2062− * usleep_range() instead of udelay(). The sleep improves responsiveness
2063+ * usleep_range_state() instead of udelay(). The sleep improves responsiveness
20632064 * by avoiding the CPU-hogging busy-wait of udelay(), and the range reduces
20642065 * power usage by allowing hrtimers to take advantage of an already-
20652066 * scheduled interrupt instead of scheduling a new one just for this sleep.
20662067 */
2067−void __sched usleep_range(unsigned long min, unsigned long max)
2068+void __sched usleep_range_state(unsigned long min, unsigned long max,
2069+ unsigned int state)
20682070 {
20692071 ktime_t exp = ktime_add_us(ktime_get(), min);
20702072 u64 delta = (u64)(max - min) * NSEC_PER_USEC;
20712073
20722074 for (;;) {
2073− __set_current_state(TASK_UNINTERRUPTIBLE);
2075+ __set_current_state(state);
20742076 /* Do not return before the requested sleep time has elapsed */
20752077 if (!schedule_hrtimeout_range(&exp, delta, HRTIMER_MODE_ABS))
20762078 break;
20772079 }
20782080 }
2079−EXPORT_SYMBOL(usleep_range);
2081+EXPORT_SYMBOL(usleep_range_state);
kernel/trace/ftrace.c+7−1
@@ -5217,6 +5217,7 @@ int unregister_ftrace_direct(unsigned long ip, unsigned long addr) · 5216 unmodified lines
52175217 {
52185218 struct ftrace_direct_func *direct;
52195219 struct ftrace_func_entry *entry;
5220+ struct ftrace_hash *hash;
52205221 int ret = -ENODEV;
52215222
52225223 mutex_lock(&direct_mutex);
@@ -5225,7 +5226,8 @@ int unregister_ftrace_direct(unsigned long ip, unsigned long addr) · 2 unmodified lines
52255226 if (!entry)
52265227 goto out_unlock;
52275228
5228− if (direct_functions->count == 1)
5229+ hash = direct_ops.func_hash->filter_hash;
5230+ if (hash->count == 1)
52295231 unregister_ftrace_function(&direct_ops);
52305232
52315233 ret = ftrace_set_filter_ip(&direct_ops, ip, 1, 0);
@@ -5540,6 +5542,10 @@ int unregister_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr) · 308 unmodified lines
55405542 err = unregister_ftrace_function(ops);
55415543 remove_direct_functions_hash(hash, addr);
55425544 mutex_unlock(&direct_mutex);
5545+
5546+ /* cleanup for possible another register call */
5547+ ops->func = NULL;
5548+ ops->trampoline = 0;
55435549 return err;
55445550 }
55455551 EXPORT_SYMBOL_GPL(unregister_ftrace_direct_multi);
kernel/trace/trace_events_synth.c+6−5
@@ -1237,9 +1237,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 1236 unmodified lines
12371237 argv + consumed, &consumed,
12381238 &field_version);
12391239 if (IS_ERR(field)) {
1240− argv_free(argv);
12411240 ret = PTR_ERR(field);
1242− goto err;
1241+ goto err_free_arg;
12431242 }
12441243
12451244 /*
@@ -1262,18 +1261,19 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 16 unmodified lines
12621261 if (cmd_version > 1 && n_fields_this_loop >= 1) {
12631262 synth_err(SYNTH_ERR_INVALID_CMD, errpos(field_str));
12641263 ret = -EINVAL;
1265− goto err;
1264+ goto err_free_arg;
12661265 }
12671266
12681267 fields[n_fields++] = field;
12691268 if (n_fields == SYNTH_FIELDS_MAX) {
12701269 synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);
12711270 ret = -EINVAL;
1272− goto err;
1271+ goto err_free_arg;
12731272 }
12741273
12751274 n_fields_this_loop++;
12761275 }
1276+ argv_free(argv);
12771277
12781278 if (consumed < argc) {
12791279 synth_err(SYNTH_ERR_INVALID_CMD, 0);
@@ -1281,7 +1281,6 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 1 unmodified line
12811281 goto err;
12821282 }
12831283
1284− argv_free(argv);
12851284 }
12861285
12871286 if (n_fields == 0) {
@@ -1307,6 +1306,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 19 unmodified lines
13071306 kfree(saved_fields);
13081307
13091308 return ret;
1309+ err_free_arg:
1310+ argv_free(argv);
13101311 err:
13111312 for (i = 0; i < n_fields; i++)
13121313 free_synth_field(fields[i]);