Merge tag 'net-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, can and netfilter. Current release - regressions: - bpf: do not reject when the stack read size is different from the tracked scalar size - net: fix premature exit from NAPI state polling in napi_disable() - riscv, bpf: fix RV32 broken build, and silence RV64 warning Current release - new code bugs: - net: fix possible NULL deref in sock_reserve_memory - amt: fix error return code in amt_init(); fix stopping the workqueue - ax88796c: use the correct ioctl callback Previous releases - always broken: - bpf: stop caching subprog index in the bpf_pseudo_func insn - security: fixups for the security hooks in sctp - nfc: add necessary privilege flags in netlink layer, limit operations to admin only - vsock: prevent unnecessary refcnt inc for non-blocking connect - net/smc: fix sk_refcnt underflow on link down and fallback - nfnetlink_queue: fix OOB when mac header was cleared - can: j1939: ignore invalid messages per standard - bpf, sockmap: - fix race in ingress receive verdict with redirect to self - fix incorrect sk_skb data_end access when src_reg = dst_reg - strparser, and tls are reusing qdisc_skb_cb and colliding - ethtool: fix ethtool msg len calculation for pause stats - vlan: fix a UAF in vlan_dev_real_dev() when ref-holder tries to access an unregistering real_dev - udp6: make encap_rcv() bump the v6 not v4 stats - drv: prestera: add explicit padding to fix m68k build - drv: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge - drv: mvpp2: fix wrong SerDes reconfiguration order Misc & small latecomers: - ipvs: auto-load ipvs on genl access - mctp: sanity check the struct sockaddr_mctp padding fields - libfs: support RENAME_EXCHANGE in simple_rename() - avoid double accounting for pure zerocopy skbs" * tag 'net-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (123 commits) selftests/net: udpgso_bench_rx: fix port argument net: wwan: iosm: fix compilation warning cxgb4: fix eeprom len when diagnostics not implemented net: fix premature exit from NAPI state polling in napi_disable() net/smc: fix sk_refcnt underflow on linkdown and fallback net/mlx5: Lag, fix a potential Oops with mlx5_lag_create_definer() gve: fix unmatched u64_stats_update_end() net: ethernet: lantiq_etop: Fix compilation error selftests: forwarding: Fix packet matching in mirroring selftests vsock: prevent unnecessary refcnt inc for nonblocking connect net: marvell: mvpp2: Fix wrong SerDes reconfiguration order net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory net: stmmac: allow a tc-taprio base-time of zero selftests: net: test_vxlan_under_vrf: fix HV connectivity test net: hns3: allow configure ETS bandwidth of all TCs net: hns3: remove check VF uc mac exist when set by PF net: hns3: fix some mac statistics is always 0 in device version V2 net: hns3: fix kernel crash when unload VF while it is being reset net: hns3: sync rx ring head in echo common pull net: hns3: fix pfc packet number incorrect after querying pfc parameters ...

Linus Torvalds committed 5 years ago

Commit f54ca912 parents c55a041 d336509134 files · +1242 −730Browse files

Showing the changes to kernel (2 of 134 files). Show all

Unified · Split

2 files

kernel/bpf/core.c +7 −0
kernel/bpf/verifier.c +20 −35

kernel/bpf/core.c+7−0

@@ -390,6 +390,13 @@ static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, s32 end_old, · 389 unmodified lines
390	i = end_new;	390	i = end_new;
391	insn = prog->insnsi + end_old;	391	insn = prog->insnsi + end_old;
392	}	392	}
		393	if (bpf_pseudo_func(insn)) {
		394	ret = bpf_adj_delta_to_imm(insn, pos, end_old,
		395	end_new, i, probe_pass);
		396	if (ret)
		397	return ret;
		398	continue;
		399	}
393	code = insn->code;	400	code = insn->code;
394	if ((BPF_CLASS(code) != BPF_JMP &&	401	if ((BPF_CLASS(code) != BPF_JMP &&
395	BPF_CLASS(code) != BPF_JMP32) \|\|	402	BPF_CLASS(code) != BPF_JMP32) \|\|

kernel/bpf/verifier.c+20−35

@@ -240,12 +240,6 @@ static bool bpf_pseudo_kfunc_call(const struct bpf_insn *insn) · 239 unmodified lines
240	insn->src_reg == BPF_PSEUDO_KFUNC_CALL;	240	insn->src_reg == BPF_PSEUDO_KFUNC_CALL;
241	}	241	}
242		242
243	static bool bpf_pseudo_func(const struct bpf_insn *insn)
244	{
245	return insn->code == (BPF_LD \| BPF_IMM \| BPF_DW) &&
246	insn->src_reg == BPF_PSEUDO_FUNC;
247	}
248
249	struct bpf_call_arg_meta {	243	struct bpf_call_arg_meta {
250	struct bpf_map *map_ptr;	244	struct bpf_map *map_ptr;
251	bool raw_mode;	245	bool raw_mode;
@@ -1960,16 +1954,10 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env) · 1708 unmodified lines
1960	return -EPERM;	1954	return -EPERM;
1961	}	1955	}
1962		1956
1963	if (bpf_pseudo_func(insn)) {	1957	if (bpf_pseudo_func(insn) \|\| bpf_pseudo_call(insn))
1964	ret = add_subprog(env, i + insn->imm + 1);
1965	if (ret >= 0)
1966	/* remember subprog */
1967	insn[1].imm = ret;
1968	} else if (bpf_pseudo_call(insn)) {
1969	ret = add_subprog(env, i + insn->imm + 1);	1958	ret = add_subprog(env, i + insn->imm + 1);
1970	} else {	1959	else
1971	ret = add_kfunc_call(env, insn->imm, insn->off);	1960	ret = add_kfunc_call(env, insn->imm, insn->off);
1972	}
1973		1961
1974	if (ret < 0)	1962	if (ret < 0)
1975	return ret;	1963	return ret;
@@ -3088,9 +3076,12 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, · 1112 unmodified lines
3088	reg = &reg_state->stack[spi].spilled_ptr;	3076	reg = &reg_state->stack[spi].spilled_ptr;
3089		3077
3090	if (is_spilled_reg(&reg_state->stack[spi])) {	3078	if (is_spilled_reg(&reg_state->stack[spi])) {
3091	if (size != BPF_REG_SIZE) {	3079	u8 spill_size = 1;
3092	u8 scalar_size = 0;	3080
		3081	for (i = BPF_REG_SIZE - 1; i > 0 && stype[i - 1] == STACK_SPILL; i--)
		3082	spill_size++;
3093		3083
		3084	if (size != BPF_REG_SIZE \|\| spill_size != BPF_REG_SIZE) {
3094	if (reg->type != SCALAR_VALUE) {	3085	if (reg->type != SCALAR_VALUE) {
3095	verbose_linfo(env, env->insn_idx, "; ");	3086	verbose_linfo(env, env->insn_idx, "; ");
3096	verbose(env, "invalid size of register fill\n");	3087	verbose(env, "invalid size of register fill\n");
@@ -3101,10 +3092,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, · 4 unmodified lines
3101	if (dst_regno < 0)	3092	if (dst_regno < 0)
3102	return 0;	3093	return 0;
3103		3094
3104	for (i = BPF_REG_SIZE; i > 0 && stype[i - 1] == STACK_SPILL; i--)	3095	if (!(off % BPF_REG_SIZE) && size == spill_size) {
3105	scalar_size++;
3106
3107	if (!(off % BPF_REG_SIZE) && size == scalar_size) {
3108	/* The earlier check_reg_arg() has decided the	3096	/* The earlier check_reg_arg() has decided the
3109	* subreg_def for this insn. Save it first.	3097	* subreg_def for this insn. Save it first.
3110	*/	3098	*/
@@ -3128,12 +3116,6 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, · 17 unmodified lines
3128	state->regs[dst_regno].live \|= REG_LIVE_WRITTEN;	3116	state->regs[dst_regno].live \|= REG_LIVE_WRITTEN;
3129	return 0;	3117	return 0;
3130	}	3118	}
3131	for (i = 1; i < BPF_REG_SIZE; i++) {
3132	if (stype[(slot - i) % BPF_REG_SIZE] != STACK_SPILL) {
3133	verbose(env, "corrupted spill memory\n");
3134	return -EACCES;
3135	}
3136	}
3137		3119
3138	if (dst_regno >= 0) {	3120	if (dst_regno >= 0) {
3139	/* restore register state from stack */	3121	/* restore register state from stack */
@@ -9393,7 +9375,8 @@ static int check_ld_imm(struct bpf_verifier_env env, struct bpf_insn insn) · 6253 unmodified lines
9393		9375
9394	if (insn->src_reg == BPF_PSEUDO_FUNC) {	9376	if (insn->src_reg == BPF_PSEUDO_FUNC) {
9395	struct bpf_prog_aux *aux = env->prog->aux;	9377	struct bpf_prog_aux *aux = env->prog->aux;
9396	u32 subprogno = insn[1].imm;	9378	u32 subprogno = find_subprog(env,
		9379	env->insn_idx + insn->imm + 1);
9397		9380
9398	if (!aux->func_info) {	9381	if (!aux->func_info) {
9399	verbose(env, "missing btf func_info\n");	9382	verbose(env, "missing btf func_info\n");
@@ -12563,14 +12546,9 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 3163 unmodified lines
12563	return 0;	12546	return 0;
12564		12547
12565	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {	12548	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {
12566	if (bpf_pseudo_func(insn)) {	12549	if (!bpf_pseudo_func(insn) && !bpf_pseudo_call(insn))
12567	env->insn_aux_data[i].call_imm = insn->imm;
12568	/* subprog is encoded in insn[1].imm */
12569	continue;	12550	continue;
12570	}
12571		12551
12572	if (!bpf_pseudo_call(insn))
12573	continue;
12574	/* Upon error here we cannot fall back to interpreter but	12552	/* Upon error here we cannot fall back to interpreter but
12575	* need a hard reject of the program. Thus -EFAULT is	12553	* need a hard reject of the program. Thus -EFAULT is
12576	* propagated in any case.	12554	* propagated in any case.
@@ -12591,6 +12569,12 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 14 unmodified lines
12591	env->insn_aux_data[i].call_imm = insn->imm;	12569	env->insn_aux_data[i].call_imm = insn->imm;
12592	/* point imm to __bpf_call_base+1 from JITs point of view */	12570	/* point imm to __bpf_call_base+1 from JITs point of view */
12593	insn->imm = 1;	12571	insn->imm = 1;
		12572	if (bpf_pseudo_func(insn))
		12573	/* jit (e.g. x86_64) may emit fewer instructions
		12574	* if it learns a u32 imm is the same as a u64 imm.
		12575	* Force a non zero here.
		12576	*/
		12577	insn[1].imm = 1;
12594	}	12578	}
12595		12579
12596	err = bpf_prog_alloc_jited_linfo(prog);	12580	err = bpf_prog_alloc_jited_linfo(prog);
@@ -12675,7 +12659,7 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 78 unmodified lines
12675	insn = func[i]->insnsi;	12659	insn = func[i]->insnsi;
12676	for (j = 0; j < func[i]->len; j++, insn++) {	12660	for (j = 0; j < func[i]->len; j++, insn++) {
12677	if (bpf_pseudo_func(insn)) {	12661	if (bpf_pseudo_func(insn)) {
12678	subprog = insn[1].imm;	12662	subprog = insn->off;
12679	insn[0].imm = (u32)(long)func[subprog]->bpf_func;	12663	insn[0].imm = (u32)(long)func[subprog]->bpf_func;
12680	insn[1].imm = ((u64)(long)func[subprog]->bpf_func) >> 32;	12664	insn[1].imm = ((u64)(long)func[subprog]->bpf_func) >> 32;
12681	continue;	12665	continue;
@@ -12726,7 +12710,8 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 44 unmodified lines
12726	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {	12710	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {
12727	if (bpf_pseudo_func(insn)) {	12711	if (bpf_pseudo_func(insn)) {
12728	insn[0].imm = env->insn_aux_data[i].call_imm;	12712	insn[0].imm = env->insn_aux_data[i].call_imm;
12729	insn[1].imm = find_subprog(env, i + insn[0].imm + 1);	12713	insn[1].imm = insn->off;
		12714	insn->off = 0;
12730	continue;	12715	continue;
12731	}	12716	}
12732	if (!bpf_pseudo_call(insn))	12717	if (!bpf_pseudo_call(insn))