Pull networking fixes from David Miller: 1) BPF verifier fixes from Daniel Borkmann. 2) HNS driver fixes from Huazhong Tan. 3) FDB only works for ethernet devices, reject attempts to install FDB rules for others. From Ido Schimmel. 4) Fix spectre V1 in vhost, from Jason Wang. 5) Don't pass on-stack object to irq_set_affinity_hint() in mvpp2 driver, from Marc Zyngier. 6) Fix mlx5e checksum handling when RXFCS is enabled, from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (49 commits) openvswitch: Fix push/pop ethernet validation net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules bpf: test make sure to run unpriv test cases in test_verifier bpf: add various test cases to test_verifier bpf: don't set id on after map lookup with ptr_to_map_val return bpf: fix partial copy of map_ptr when dst is scalar libbpf: Fix compile error in libbpf_attach_type_by_name kselftests/bpf: use ping6 as the default ipv6 ping binary if it exists selftests: mlxsw: qos_mc_aware: Add a test for UC awareness selftests: mlxsw: qos_mc_aware: Tweak for min shaper mlxsw: spectrum: Set minimum shaper on MC TCs mlxsw: reg: QEEC: Add minimum shaper fields net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset() net: hns3: bugfix for rtnl_lock's range in the hclge_reset() net: hns3: bugfix for handling mailbox while the command queue reinitialized net: hns3: fix incorrect return value/type of some functions net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read net: hns3: bugfix for is_valid_csq_clean_head() net: hns3: remove unnecessary queue reset in the hns3_uninit_all_ring() net: hns3: bugfix for the initialization of command queue's spin lock ...
Showing the changes to kernel (1 of 56 files). Show all
Unified · Split
| @@ -2852,10 +2852,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn · 2851 unmodified lines | ||
| 2852 | 2852 | regs[BPF_REG_0].type = NOT_INIT; |
| 2853 | 2853 | } else if (fn->ret_type == RET_PTR_TO_MAP_VALUE_OR_NULL || |
| 2854 | 2854 | fn->ret_type == RET_PTR_TO_MAP_VALUE) { |
| 2855 | − if (fn->ret_type == RET_PTR_TO_MAP_VALUE) | |
| 2856 | − regs[BPF_REG_0].type = PTR_TO_MAP_VALUE; | |
| 2857 | − else | |
| 2858 | − regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL; | |
| 2859 | 2855 | /* There is no offset yet applied, variable or fixed */ |
| 2860 | 2856 | mark_reg_known_zero(env, regs, BPF_REG_0); |
| 2861 | 2857 | /* remember map_ptr, so that check_map_access() |
| @@ -2868,7 +2864,12 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn · 6 unmodified lines | ||
| 2868 | 2864 | return -EINVAL; |
| 2869 | 2865 | } |
| 2870 | 2866 | regs[BPF_REG_0].map_ptr = meta.map_ptr; |
| 2871 | − regs[BPF_REG_0].id = ++env->id_gen; | |
| 2867 | + if (fn->ret_type == RET_PTR_TO_MAP_VALUE) { | |
| 2868 | + regs[BPF_REG_0].type = PTR_TO_MAP_VALUE; | |
| 2869 | + } else { | |
| 2870 | + regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL; | |
| 2871 | + regs[BPF_REG_0].id = ++env->id_gen; | |
| 2872 | + } | |
| 2872 | 2873 | } else if (fn->ret_type == RET_PTR_TO_SOCKET_OR_NULL) { |
| 2873 | 2874 | int id = acquire_reference_state(env, insn_idx); |
| 2874 | 2875 | if (id < 0) |
| @@ -3046,7 +3047,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 171 unmodified lines | ||
| 3046 | 3047 | dst_reg->umax_value = umax_ptr; |
| 3047 | 3048 | dst_reg->var_off = ptr_reg->var_off; |
| 3048 | 3049 | dst_reg->off = ptr_reg->off + smin_val; |
| 3049 | − dst_reg->range = ptr_reg->range; | |
| 3050 | + dst_reg->raw = ptr_reg->raw; | |
| 3050 | 3051 | break; |
| 3051 | 3052 | } |
| 3052 | 3053 | /* A new variable offset is created. Note that off_reg->off |
| @@ -3076,10 +3077,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 23 unmodified lines | ||
| 3076 | 3077 | } |
| 3077 | 3078 | dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off); |
| 3078 | 3079 | dst_reg->off = ptr_reg->off; |
| 3080 | + dst_reg->raw = ptr_reg->raw; | |
| 3079 | 3081 | if (reg_is_pkt_pointer(ptr_reg)) { |
| 3080 | 3082 | dst_reg->id = ++env->id_gen; |
| 3081 | 3083 | /* something was added to pkt_ptr, set range to zero */ |
| 3082 | − dst_reg->range = 0; | |
| 3084 | + dst_reg->raw = 0; | |
| 3083 | 3085 | } |
| 3084 | 3086 | break; |
| 3085 | 3087 | case BPF_SUB: |
| @@ -3108,7 +3110,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 22 unmodified lines | ||
| 3108 | 3110 | dst_reg->var_off = ptr_reg->var_off; |
| 3109 | 3111 | dst_reg->id = ptr_reg->id; |
| 3110 | 3112 | dst_reg->off = ptr_reg->off - smin_val; |
| 3111 | − dst_reg->range = ptr_reg->range; | |
| 3113 | + dst_reg->raw = ptr_reg->raw; | |
| 3112 | 3114 | break; |
| 3113 | 3115 | } |
| 3114 | 3116 | /* A new variable offset is created. If the subtrahend is known |
| @@ -3134,11 +3136,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 19 unmodified lines | ||
| 3134 | 3136 | } |
| 3135 | 3137 | dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off); |
| 3136 | 3138 | dst_reg->off = ptr_reg->off; |
| 3139 | + dst_reg->raw = ptr_reg->raw; | |
| 3137 | 3140 | if (reg_is_pkt_pointer(ptr_reg)) { |
| 3138 | 3141 | dst_reg->id = ++env->id_gen; |
| 3139 | 3142 | /* something was added to pkt_ptr, set range to zero */ |
| 3140 | 3143 | if (smin_val < 0) |
| 3141 | − dst_reg->range = 0; | |
| 3144 | + dst_reg->raw = 0; | |
| 3142 | 3145 | } |
| 3143 | 3146 | break; |
| 3144 | 3147 | case BPF_AND: |