History

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov: - Fix incorrect usage of BPF_TRAMP_F_ORIG_STACK in riscv JIT (Menglong Dong) - Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) - Fix metadata size check in bpf_test_run() (Toke Høiland-Jørgensen) - Check that BPF insn array is not allowed as a map for const strings (Deepanshu Kartikey) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix reference count leak in bpf_prog_test_run_xdp() bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() selftests/bpf: Update xdp_context_test_run test to check maximum metadata size bpf, test_run: Subtract size of xdp_frame from allowed metadata size riscv, bpf: Fix incorrect usage of BPF_TRAMP_F_ORIG_STACK

Linus Torvalds committed 10 months ago

Commit c537e122 parents b543459 ec69daa4 files · +35 −15Browse files

Unified · Split

4 files
  1. arch/riscv/net/bpf_jit_comp64.c +2 −4
  2. kernel/bpf/verifier.c +5 −0
  3. net/bpf/test_run.c +17 −8
  4. tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c +11 −3
arch/riscv/net/bpf_jit_comp64.c+2−4
@@ -1133,10 +1133,6 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, · 1132 unmodified lines
11331133
11341134 store_args(nr_arg_slots, args_off, ctx);
11351135
1136− /* skip to actual body of traced function */
1137− if (flags & BPF_TRAMP_F_ORIG_STACK)
1138− orig_call += RV_FENTRY_NINSNS * 4;
1139−
11401136 if (flags & BPF_TRAMP_F_CALL_ORIG) {
11411137 emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx);
11421138 ret = emit_call((const u64)__bpf_tramp_enter, true, ctx);
@@ -1171,6 +1167,8 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, · 28 unmodified lines
11711167 }
11721168
11731169 if (flags & BPF_TRAMP_F_CALL_ORIG) {
1170+ /* skip to actual body of traced function */
1171+ orig_call += RV_FENTRY_NINSNS * 4;
11741172 restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx);
11751173 restore_stack_args(nr_arg_slots - RV_MAX_REG_ARGS, args_off, stk_arg_off, ctx);
11761174 ret = emit_call((const u64)orig_call, true, ctx);
kernel/bpf/verifier.c+5−0
@@ -9609,6 +9609,11 @@ static int check_reg_const_str(struct bpf_verifier_env *env, · 9608 unmodified lines
96099609 if (reg->type != PTR_TO_MAP_VALUE)
96109610 return -EINVAL;
96119611
9612+ if (map->map_type == BPF_MAP_TYPE_INSN_ARRAY) {
9613+ verbose(env, "R%d points to insn_array map which cannot be used as const string\n", regno);
9614+ return -EACCES;
9615+ }
9616+
96129617 if (!bpf_map_is_rdonly(map)) {
96139618 verbose(env, "R%d does not point to a readonly map'\n", regno);
96149619 return -EACCES;
net/bpf/test_run.c+17−8
@@ -1294,8 +1294,6 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, · 1293 unmodified lines
12941294 batch_size = NAPI_POLL_WEIGHT;
12951295 else if (batch_size > TEST_XDP_MAX_BATCH)
12961296 return -E2BIG;
1297−
1298− headroom += sizeof(struct xdp_page_head);
12991297 } else if (batch_size) {
13001298 return -EINVAL;
13011299 }
@@ -1308,16 +1306,26 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, · 6 unmodified lines
13081306 /* There can't be user provided data before the meta data */
13091307 if (ctx->data_meta || ctx->data_end > kattr->test.data_size_in ||
13101308 ctx->data > ctx->data_end ||
1311− unlikely(xdp_metalen_invalid(ctx->data)) ||
13121309 (do_live && (kattr->test.data_out || kattr->test.ctx_out)))
13131310 goto free_ctx;
1314− /* Meta data is allocated from the headroom */
1315− headroom -= ctx->data;
13161311
13171312 meta_sz = ctx->data;
1313+ if (xdp_metalen_invalid(meta_sz) || meta_sz > headroom - sizeof(struct xdp_frame))
1314+ goto free_ctx;
1315+
1316+ /* Meta data is allocated from the headroom */
1317+ headroom -= meta_sz;
13181318 linear_sz = ctx->data_end;
13191319 }
13201320
1321+ /* The xdp_page_head structure takes up space in each page, limiting the
1322+ * size of the packet data; add the extra size to headroom here to make
1323+ * sure it's accounted in the length checks below, but not in the
1324+ * metadata size check above.
1325+ */
1326+ if (do_live)
1327+ headroom += sizeof(struct xdp_page_head);
1328+
13211329 max_linear_sz = PAGE_SIZE - headroom - tailroom;
13221330 linear_sz = min_t(u32, linear_sz, max_linear_sz);
13231331
@@ -1355,13 +1363,13 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, · 31 unmodified lines
13551363
13561364 if (sinfo->nr_frags == MAX_SKB_FRAGS) {
13571365 ret = -ENOMEM;
1358− goto out;
1366+ goto out_put_dev;
13591367 }
13601368
13611369 page = alloc_page(GFP_KERNEL);
13621370 if (!page) {
13631371 ret = -ENOMEM;
1364− goto out;
1372+ goto out_put_dev;
13651373 }
13661374
13671375 frag = &sinfo->frags[sinfo->nr_frags++];
@@ -1373,7 +1381,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, · 5 unmodified lines
13731381 if (copy_from_user(page_address(page), data_in + size,
13741382 data_len)) {
13751383 ret = -EFAULT;
1376− goto out;
1384+ goto out_put_dev;
13771385 }
13781386 sinfo->xdp_frags_size += data_len;
13791387 size += data_len;
@@ -1388,6 +1396,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, · 8 unmodified lines
13881396 ret = bpf_test_run_xdp_live(prog, &xdp, repeat, batch_size, &duration);
13891397 else
13901398 ret = bpf_test_run(prog, &xdp, repeat, &retval, &duration, true);
1399+out_put_dev:
13911400 /* We convert the xdp_buff back to an xdp_md before checking the return
13921401 * code so the reference count of any held netdevice will be decremented
13931402 * even if the test run failed.
tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c+11−3
@@ -47,6 +47,7 @@ void test_xdp_context_test_run(void) · 46 unmodified lines
4747 struct test_xdp_context_test_run *skel = NULL;
4848 char data[sizeof(pkt_v4) + sizeof(__u32)];
4949 char bad_ctx[sizeof(struct xdp_md) + 1];
50+ char large_data[256];
5051 struct xdp_md ctx_in, ctx_out;
5152 DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
5253 .data_in = &data,
@@ -94,9 +95,6 @@ void test_xdp_context_test_run(void) · 41 unmodified lines
9495 test_xdp_context_error(prog_fd, opts, 4, sizeof(__u32), sizeof(data),
9596 0, 0, 0);
9697
97− /* Meta data must be 255 bytes or smaller */
98− test_xdp_context_error(prog_fd, opts, 0, 256, sizeof(data), 0, 0, 0);
99−
10098 /* Total size of data must be data_end - data_meta or larger */
10199 test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32),
102100 sizeof(data) + 1, 0, 0, 0);
@@ -116,6 +114,16 @@ void test_xdp_context_test_run(void) · 13 unmodified lines
116114 test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32), sizeof(data),
117115 0, 0, 1);
118116
117+ /* Meta data must be 216 bytes or smaller (256 - sizeof(struct
118+ * xdp_frame)). Test both nearest invalid size and nearest invalid
119+ * 4-byte-aligned size, and make sure data_in is large enough that we
120+ * actually hit the check on metadata length
121+ */
122+ opts.data_in = large_data;
123+ opts.data_size_in = sizeof(large_data);
124+ test_xdp_context_error(prog_fd, opts, 0, 217, sizeof(large_data), 0, 0, 0);
125+ test_xdp_context_error(prog_fd, opts, 0, 220, sizeof(large_data), 0, 0, 0);
126+
119127 test_xdp_context_test_run__destroy(skel);
120128 }
121129