History

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov: - Mark migrate_disable/enable() as always_inline to avoid issues with partial inlining (Yonghong Song) - Fix powerpc stack register definition in libbpf bpf_tracing.h (Andrii Nakryiko) - Reject negative head_room in __bpf_skb_change_head (Daniel Borkmann) - Conditionally include dynptr copy kfuncs (Malin Jonsson) - Sync pending IRQ work before freeing BPF ring buffer (Noorain Eqbal) - Do not audit capability check in x86 do_jit() (Ondrej Mosnacek) - Fix arm64 JIT of BPF_ST insn when it writes into arena memory (Puranjay Mohan) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf/arm64: Fix BPF_ST into arena memory bpf: Make migrate_disable always inline to avoid partial inlining bpf: Reject negative head_room in __bpf_skb_change_head bpf: Conditionally include dynptr copy kfuncs libbpf: Fix powerpc's stack register definition in bpf_tracing.h bpf: Do not audit capability check in do_jit() bpf: Sync pending IRQ work before freeing ring buffer

Linus Torvalds committed 1 year ago

Commit ba36dd52 parents ec0b62c be708ed7 files · +13 −7Browse files

Unified · Split

7 files
  1. arch/arm64/net/bpf_jit_comp.c +3 −2
  2. arch/x86/net/bpf_jit_comp.c +1 −1
  3. include/linux/sched.h +2 −2
  4. kernel/bpf/helpers.c +2 −0
  5. kernel/bpf/ringbuf.c +2 −0
  6. net/core/filter.c +2 −1
  7. tools/lib/bpf/bpf_tracing.h +1 −1
arch/arm64/net/bpf_jit_comp.c+3−2
@@ -1213,6 +1213,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, · 1212 unmodified lines
12131213 u8 src = bpf2a64[insn->src_reg];
12141214 const u8 tmp = bpf2a64[TMP_REG_1];
12151215 const u8 tmp2 = bpf2a64[TMP_REG_2];
1216+ const u8 tmp3 = bpf2a64[TMP_REG_3];
12161217 const u8 fp = bpf2a64[BPF_REG_FP];
12171218 const u8 arena_vm_base = bpf2a64[ARENA_VM_START];
12181219 const u8 priv_sp = bpf2a64[PRIVATE_SP];
@@ -1757,8 +1758,8 @@ emit_cond_jmp: · 538 unmodified lines
17571758 case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
17581759 case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
17591760 if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
1760− emit(A64_ADD(1, tmp2, dst, arena_vm_base), ctx);
1761− dst = tmp2;
1761+ emit(A64_ADD(1, tmp3, dst, arena_vm_base), ctx);
1762+ dst = tmp3;
17621763 }
17631764 if (dst == fp) {
17641765 dst_adj = ctx->priv_sp_used ? priv_sp : A64_SP;
arch/x86/net/bpf_jit_comp.c+1−1
@@ -2701,7 +2701,7 @@ emit_jmp: · 2700 unmodified lines
27012701 /* Update cleanup_addr */
27022702 ctx->cleanup_addr = proglen;
27032703 if (bpf_prog_was_classic(bpf_prog) &&
2704− !capable(CAP_SYS_ADMIN)) {
2704+ !ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN)) {
27052705 u8 *ip = image + addrs[i - 1];
27062706
27072707 if (emit_spectre_bhb_barrier(&prog, ip, bpf_prog))
include/linux/sched.h+2−2
@@ -2407,12 +2407,12 @@ static inline void __migrate_enable(void) { } · 2406 unmodified lines
24072407 * be defined in kernel/sched/core.c.
24082408 */
24092409 #ifndef INSTANTIATE_EXPORTED_MIGRATE_DISABLE
2410−static inline void migrate_disable(void)
2410+static __always_inline void migrate_disable(void)
24112411 {
24122412 __migrate_disable();
24132413 }
24142414
2415−static inline void migrate_enable(void)
2415+static __always_inline void migrate_enable(void)
24162416 {
24172417 __migrate_enable();
24182418 }
kernel/bpf/helpers.c+2−0
@@ -4345,6 +4345,7 @@ BTF_ID_FLAGS(func, bpf_iter_kmem_cache_next, KF_ITER_NEXT | KF_RET_NULL | KF_SLE · 4344 unmodified lines
43454345 BTF_ID_FLAGS(func, bpf_iter_kmem_cache_destroy, KF_ITER_DESTROY | KF_SLEEPABLE)
43464346 BTF_ID_FLAGS(func, bpf_local_irq_save)
43474347 BTF_ID_FLAGS(func, bpf_local_irq_restore)
4348+#ifdef CONFIG_BPF_EVENTS
43484349 BTF_ID_FLAGS(func, bpf_probe_read_user_dynptr)
43494350 BTF_ID_FLAGS(func, bpf_probe_read_kernel_dynptr)
43504351 BTF_ID_FLAGS(func, bpf_probe_read_user_str_dynptr)
@@ -4353,6 +4354,7 @@ BTF_ID_FLAGS(func, bpf_copy_from_user_dynptr, KF_SLEEPABLE) · 2 unmodified lines
43534354 BTF_ID_FLAGS(func, bpf_copy_from_user_str_dynptr, KF_SLEEPABLE)
43544355 BTF_ID_FLAGS(func, bpf_copy_from_user_task_dynptr, KF_SLEEPABLE | KF_TRUSTED_ARGS)
43554356 BTF_ID_FLAGS(func, bpf_copy_from_user_task_str_dynptr, KF_SLEEPABLE | KF_TRUSTED_ARGS)
4357+#endif
43564358 #ifdef CONFIG_DMA_SHARED_BUFFER
43574359 BTF_ID_FLAGS(func, bpf_iter_dmabuf_new, KF_ITER_NEW | KF_SLEEPABLE)
43584360 BTF_ID_FLAGS(func, bpf_iter_dmabuf_next, KF_ITER_NEXT | KF_RET_NULL | KF_SLEEPABLE)
kernel/bpf/ringbuf.c+2−0
@@ -216,6 +216,8 @@ static struct bpf_map *ringbuf_map_alloc(union bpf_attr *attr) · 215 unmodified lines
216216
217217 static void bpf_ringbuf_free(struct bpf_ringbuf *rb)
218218 {
219+ irq_work_sync(&rb->work);
220+
219221 /* copy pages pointer and nr_pages to local variable, as we are going
220222 * to unmap rb itself with vunmap() below
221223 */
net/core/filter.c+2−1
@@ -3877,7 +3877,8 @@ static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room, · 3876 unmodified lines
38773877 u32 new_len = skb->len + head_room;
38783878 int ret;
38793879
3880− if (unlikely(flags || (!skb_is_gso(skb) && new_len > max_len) ||
3880+ if (unlikely(flags || (int)head_room < 0 ||
3881+ (!skb_is_gso(skb) && new_len > max_len) ||
38813882 new_len < skb->len))
38823883 return -EINVAL;
38833884
tools/lib/bpf/bpf_tracing.h+1−1
@@ -311,7 +311,7 @@ struct pt_regs___arm64 { · 310 unmodified lines
311311 #define __PT_RET_REG regs[31]
312312 #define __PT_FP_REG __unsupported__
313313 #define __PT_RC_REG gpr[3]
314−#define __PT_SP_REG sp
314+#define __PT_SP_REG gpr[1]
315315 #define __PT_IP_REG nip
316316
317317 #elif defined(bpf_target_sparc)