Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov: - Fix how linked registers track zero extension of subregisters (Daniel Borkmann) - Fix unsound scalar fork for OR instructions (Daniel Wade) - Fix exception exit lock check for subprogs (Ihor Solodrai) - Fix undefined behavior in interpreter for SDIV/SMOD instructions (Jenny Guanni Qu) - Release module's BTF when module is unloaded (Kumar Kartikeya Dwivedi) - Fix constant blinding for PROBE_MEM32 instructions (Sachin Kumar) - Reset register ID for END instructions to prevent incorrect value tracking (Yazhou Tang) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add a test cases for sync_linked_regs regarding zext propagation bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation selftests/bpf: Add tests for maybe_fork_scalars() OR vs AND handling bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN selftests/bpf: Add tests for bpf_throw lock leak from subprogs bpf: Fix exception exit lock checking for subprogs bpf: Release module BTF IDR before module unload selftests/bpf: Fix pkg-config call on static builds bpf: Fix constant blinding for PROBE_MEM32 stores selftests/bpf: Add test for BPF_END register ID reset bpf: Reset register ID for BPF_END value tracking

Linus Torvalds committed 7 months ago

Commit d5273fd2 parents ac57fa9 4a04d139 files · +416 −24Browse files

Showing the changes to kernel (3 of 9 files). Show all

Unified · Split

3 files

kernel/bpf/btf.c +20 −4
kernel/bpf/core.c +35 −8
kernel/bpf/verifier.c +25 −8

kernel/bpf/btf.c+20−4

 	 * of the _bh() version.
 	 */
 	spin_lock_irqsave(&btf_idr_lock, flags);
-	idr_remove(&btf_idr, btf->id);
+	if (btf->id) {
+		idr_remove(&btf_idr, btf->id);
+		/*
+		 * Clear the id here to make this function idempotent, since it will get
+		 * called a couple of times for module BTFs: on module unload, and then
+		 * the final btf_put(). btf_alloc_id() starts IDs with 1, so we can use
+		 * 0 as sentinel value.
+		 */
+		WRITE_ONCE(btf->id, 0);
+	}
 	spin_unlock_irqrestore(&btf_idr_lock, flags);
 }
 {
 	const struct btf *btf = filp->private_data;
-	seq_printf(m, "btf_id:\t%u\n", btf->id);
+	seq_printf(m, "btf_id:\t%u\n", READ_ONCE(btf->id));
 }
 #endif
 	if (copy_from_user(&info, uinfo, info_copy))
 		return -EFAULT;
-	info.id = btf->id;
+	info.id = READ_ONCE(btf->id);
 	ubtf = u64_to_user_ptr(info.btf);
 	btf_copy = min_t(u32, btf->data_size, info.btf_size);
 	if (copy_to_user(ubtf, btf->data, btf_copy))
 u32 btf_obj_id(const struct btf *btf)
 {
-	return btf->id;
+	return READ_ONCE(btf->id);
 }
 bool btf_is_kernel(const struct btf *btf)
 			if (btf_mod->module != module)
 				continue;
+			/*
+			 * For modules, we do the freeing of BTF IDR as soon as
+			 * module goes away to disable BTF discovery, since the
+			 * btf_try_get_module() on such BTFs will fail. This may
+			 * be called again on btf_put(), but it's ok to do so.
+			 */
+			btf_free_id(btf_mod->btf);
 			list_del(&btf_mod->list);
 			if (btf_mod->sysfs_attr)
 				sysfs_remove_bin_file(btf_kobj, btf_mod->sysfs_attr);

kernel/bpf/core.c+35−8

 		*to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
 		*to++ = BPF_STX_MEM(from->code, from->dst_reg, BPF_REG_AX, from->off);
 		break;
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_H:
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_B:
+		*to++ = BPF_ALU64_IMM(BPF_MOV, BPF_REG_AX, imm_rnd ^
+				      from->imm);
+		*to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
+		/*
+		 * Cannot use BPF_STX_MEM() macro here as it
+		 * hardcodes BPF_MEM mode, losing PROBE_MEM32
+		 * and breaking arena addressing in the JIT.
+		 */
+		*to++ = (struct bpf_insn) {
+			.code  = BPF_STX | BPF_PROBE_MEM32 |
+				 BPF_SIZE(from->code),
+			.dst_reg = from->dst_reg,
+			.src_reg = BPF_REG_AX,
+			.off   = from->off,
+		};
+		break;
 	}
 out:
 	return to - to_buff;
 }
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
+/* Absolute value of s32 without undefined behavior for S32_MIN */
+static u32 abs_s32(s32 x)
+{
+	return x >= 0 ? (u32)x : -(u32)x;
+}
 /**
  *	___bpf_prog_run - run eBPF program on a given context
  *	@regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers
 			DST = do_div(AX, (u32) SRC);
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			AX = do_div(AX, abs((s32)SRC));
+			AX = do_div(AX, abs_s32((s32)SRC));
 			if ((s32)DST < 0)
 				DST = (u32)-AX;
 			else
 			DST = do_div(AX, (u32) IMM);
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			AX = do_div(AX, abs((s32)IMM));
+			AX = do_div(AX, abs_s32((s32)IMM));
 			if ((s32)DST < 0)
 				DST = (u32)-AX;
 			else
 			DST = (u32) AX;
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			do_div(AX, abs((s32)SRC));
+			do_div(AX, abs_s32((s32)SRC));
 			if (((s32)DST < 0) == ((s32)SRC < 0))
 				DST = (u32)AX;
 			else
 			DST = (u32) AX;
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			do_div(AX, abs((s32)IMM));
+			do_div(AX, abs_s32((s32)IMM));
 			if (((s32)DST < 0) == ((s32)IMM < 0))
 				DST = (u32)AX;
 			else

kernel/bpf/verifier.c+25−8

@@ -15910,6 +15910,13 @@ static void scalar_byte_swap(struct bpf_reg_state dst_reg, struct bpf_insn ins · 15909 unmodified lines
15910	/* Apply bswap if alu64 or switch between big-endian and little-endian machines */	15910	/* Apply bswap if alu64 or switch between big-endian and little-endian machines */
15911	bool need_bswap = alu64 \|\| (to_le == is_big_endian);	15911	bool need_bswap = alu64 \|\| (to_le == is_big_endian);
15912		15912
		15913	/*
		15914	* If the register is mutated, manually reset its scalar ID to break
		15915	* any existing ties and avoid incorrect bounds propagation.
		15916	*/
		15917	if (need_bswap \|\| insn->imm == 16 \|\| insn->imm == 32)
		15918	dst_reg->id = 0;
		15919
15913	if (need_bswap) {	15920	if (need_bswap) {
15914	if (insn->imm == 16)	15921	if (insn->imm == 16)
15915	dst_reg->var_off = tnum_bswap16(dst_reg->var_off);	15922	dst_reg->var_off = tnum_bswap16(dst_reg->var_off);
@@ -15992,7 +15999,7 @@ static int maybe_fork_scalars(struct bpf_verifier_env env, struct bpf_insn ins · 76 unmodified lines
15992	else	15999	else
15993	return 0;	16000	return 0;
15994		16001
15995	branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);	16002	branch = push_stack(env, env->insn_idx, env->insn_idx, false);
15996	if (IS_ERR(branch))	16003	if (IS_ERR(branch))
15997	return PTR_ERR(branch);	16004	return PTR_ERR(branch);
15998		16005
@@ -17408,6 +17415,12 @@ static void sync_linked_regs(struct bpf_verifier_env *env, struct bpf_verifier_s · 1409 unmodified lines
17408	continue;	17415	continue;
17409	if ((reg->id & ~BPF_ADD_CONST) != (known_reg->id & ~BPF_ADD_CONST))	17416	if ((reg->id & ~BPF_ADD_CONST) != (known_reg->id & ~BPF_ADD_CONST))
17410	continue;	17417	continue;
		17418	/*
		17419	* Skip mixed 32/64-bit links: the delta relationship doesn't
		17420	* hold across different ALU widths.
		17421	*/
		17422	if (((reg->id ^ known_reg->id) & BPF_ADD_CONST) == BPF_ADD_CONST)
		17423	continue;
17411	if ((!(reg->id & BPF_ADD_CONST) && !(known_reg->id & BPF_ADD_CONST)) \|\|	17424	if ((!(reg->id & BPF_ADD_CONST) && !(known_reg->id & BPF_ADD_CONST)) \|\|
17412	reg->off == known_reg->off) {	17425	reg->off == known_reg->off) {
17413	s32 saved_subreg_def = reg->subreg_def;	17426	s32 saved_subreg_def = reg->subreg_def;
@@ -17435,7 +17448,7 @@ static void sync_linked_regs(struct bpf_verifier_env *env, struct bpf_verifier_s · 21 unmodified lines
17435	scalar32_min_max_add(reg, &fake_reg);	17448	scalar32_min_max_add(reg, &fake_reg);
17436	scalar_min_max_add(reg, &fake_reg);	17449	scalar_min_max_add(reg, &fake_reg);
17437	reg->var_off = tnum_add(reg->var_off, fake_reg.var_off);	17450	reg->var_off = tnum_add(reg->var_off, fake_reg.var_off);
17438	if (known_reg->id & BPF_ADD_CONST32)	17451	if ((reg->id \| known_reg->id) & BPF_ADD_CONST32)
17439	zext_32_to_64(reg);	17452	zext_32_to_64(reg);
17440	reg_bounds_sync(reg);	17453	reg_bounds_sync(reg);
17441	}	17454	}
@@ -19863,11 +19876,14 @@ static bool regsafe(struct bpf_verifier_env env, struct bpf_reg_state rold, · 2421 unmodified lines
19863	* Also verify that new value satisfies old value range knowledge.	19876	* Also verify that new value satisfies old value range knowledge.
19864	*/	19877	*/
19865		19878
19866	/* ADD_CONST mismatch: different linking semantics */	19879	/*
19867	if ((rold->id & BPF_ADD_CONST) && !(rcur->id & BPF_ADD_CONST))	19880	* ADD_CONST flags must match exactly: BPF_ADD_CONST32 and
19868	return false;	19881	* BPF_ADD_CONST64 have different linking semantics in
19869		19882	* sync_linked_regs() (alu32 zero-extends, alu64 does not),
19870	if (rold->id && !(rold->id & BPF_ADD_CONST) && (rcur->id & BPF_ADD_CONST))	19883	* so pruning across different flag types is unsafe.
		19884	*/
		19885	if (rold->id &&
		19886	(rold->id & BPF_ADD_CONST) != (rcur->id & BPF_ADD_CONST))
19871	return false;	19887	return false;
19872		19888
19873	/* Both have offset linkage: offsets must match */	19889	/* Both have offset linkage: offsets must match */
@@ -20904,7 +20920,8 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env, · 1030 unmodified lines
20904	* state when it exits.	20920	* state when it exits.
20905	*/	20921	*/
20906	int err = check_resource_leak(env, exception_exit,	20922	int err = check_resource_leak(env, exception_exit,
20907	!env->cur_state->curframe,	20923	exception_exit \|\| !env->cur_state->curframe,
		20924	exception_exit ? "bpf_throw" :
20908	"BPF_EXIT instruction in main prog");	20925	"BPF_EXIT instruction in main prog");
20909	if (err)	20926	if (err)
20910	return err;	20927	return err;

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code