History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Alexei Starovoitov says: ==================== pull-request: bpf 2019-01-02 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) prevent out of bounds speculation on pointer arithmetic, from Daniel. 2) typo fix, from Xiaozhou. ====================

David S. Miller committed 7 years ago

Commit be630042 parents d63967e a67825f6 files · +1452 −108Browse files

Showing the changes to include/linux (2 of 6 files). Show all

Unified · Split

2 files
  1. include/linux/bpf_verifier.h +12 −0
  2. include/linux/filter.h +3 −7
include/linux/bpf_verifier.h+12−0
@@ -148,6 +148,7 @@ struct bpf_verifier_state { · 147 unmodified lines
148 /* call stack tracking */148 /* call stack tracking */
149 struct bpf_func_state *frame[MAX_CALL_FRAMES];149 struct bpf_func_state *frame[MAX_CALL_FRAMES];
150 u32 curframe;150 u32 curframe;
151 bool speculative;
151};152};
152 153
153#define bpf_get_spilled_reg(slot, frame) \154#define bpf_get_spilled_reg(slot, frame) \
@@ -167,15 +168,24 @@ struct bpf_verifier_state_list { · 13 unmodified lines
167 struct bpf_verifier_state_list *next;168 struct bpf_verifier_state_list *next;
168};169};
169 170
171/* Possible states for alu_state member. */
172#define BPF_ALU_SANITIZE_SRC 1U
173#define BPF_ALU_SANITIZE_DST 2U
174#define BPF_ALU_NEG_VALUE (1U << 2)
175#define BPF_ALU_SANITIZE (BPF_ALU_SANITIZE_SRC | \
176 BPF_ALU_SANITIZE_DST)
177
170struct bpf_insn_aux_data {178struct bpf_insn_aux_data {
171 union {179 union {
172 enum bpf_reg_type ptr_type; /* pointer type for load/store insns */180 enum bpf_reg_type ptr_type; /* pointer type for load/store insns */
173 unsigned long map_state; /* pointer/poison value for maps */181 unsigned long map_state; /* pointer/poison value for maps */
174 s32 call_imm; /* saved imm field of call insn */182 s32 call_imm; /* saved imm field of call insn */
183 u32 alu_limit; /* limit for add/sub register with pointer */
175 };184 };
176 int ctx_field_size; /* the ctx field size for load insn, maybe 0 */185 int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
177 int sanitize_stack_off; /* stack slot to be cleared */186 int sanitize_stack_off; /* stack slot to be cleared */
178 bool seen; /* this insn was processed by the verifier */187 bool seen; /* this insn was processed by the verifier */
188 u8 alu_state; /* used in combination with alu_limit */
179};189};
180 190
181#define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF program */191#define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF program */
@@ -212,6 +222,8 @@ struct bpf_subprog_info { · 30 unmodified lines
212 * one verifier_env per bpf_check() call222 * one verifier_env per bpf_check() call
213 */223 */
214struct bpf_verifier_env {224struct bpf_verifier_env {
225 u32 insn_idx;
226 u32 prev_insn_idx;
215 struct bpf_prog *prog; /* eBPF program being verified */227 struct bpf_prog *prog; /* eBPF program being verified */
216 const struct bpf_verifier_ops *ops;228 const struct bpf_verifier_ops *ops;
217 struct bpf_verifier_stack_elem *head; /* stack of verifier states to be processed */229 struct bpf_verifier_stack_elem *head; /* stack of verifier states to be processed */
include/linux/filter.h+3−7
@@ -53,14 +53,10 @@ struct sock_reuseport; · 52 unmodified lines
53#define BPF_REG_D BPF_REG_8 /* data, callee-saved */53#define BPF_REG_D BPF_REG_8 /* data, callee-saved */
54#define BPF_REG_H BPF_REG_9 /* hlen, callee-saved */54#define BPF_REG_H BPF_REG_9 /* hlen, callee-saved */
55 55
56/* Kernel hidden auxiliary/helper register for hardening step.56/* Kernel hidden auxiliary/helper register. */
57 * Only used by eBPF JITs. It's nothing more than a temporary
58 * register that JITs use internally, only that here it's part
59 * of eBPF instructions that have been rewritten for blinding
60 * constants. See JIT pre-step in bpf_jit_blind_constants().
61 */
62#define BPF_REG_AX MAX_BPF_REG57#define BPF_REG_AX MAX_BPF_REG
63#define MAX_BPF_JIT_REG (MAX_BPF_REG + 1)58#define MAX_BPF_EXT_REG (MAX_BPF_REG + 1)
59#define MAX_BPF_JIT_REG MAX_BPF_EXT_REG
64 60
65/* unused opcode to mark special call to bpf_tail_call() helper */61/* unused opcode to mark special call to bpf_tail_call() helper */
66#define BPF_TAIL_CALL 0xf062#define BPF_TAIL_CALL 0xf0