Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, can and netfilter. Current release - regressions: - bpf: do not reject when the stack read size is different from the tracked scalar size - net: fix premature exit from NAPI state polling in napi_disable() - riscv, bpf: fix RV32 broken build, and silence RV64 warning Current release - new code bugs: - net: fix possible NULL deref in sock_reserve_memory - amt: fix error return code in amt_init(); fix stopping the workqueue - ax88796c: use the correct ioctl callback Previous releases - always broken: - bpf: stop caching subprog index in the bpf_pseudo_func insn - security: fixups for the security hooks in sctp - nfc: add necessary privilege flags in netlink layer, limit operations to admin only - vsock: prevent unnecessary refcnt inc for non-blocking connect - net/smc: fix sk_refcnt underflow on link down and fallback - nfnetlink_queue: fix OOB when mac header was cleared - can: j1939: ignore invalid messages per standard - bpf, sockmap: - fix race in ingress receive verdict with redirect to self - fix incorrect sk_skb data_end access when src_reg = dst_reg - strparser, and tls are reusing qdisc_skb_cb and colliding - ethtool: fix ethtool msg len calculation for pause stats - vlan: fix a UAF in vlan_dev_real_dev() when ref-holder tries to access an unregistering real_dev - udp6: make encap_rcv() bump the v6 not v4 stats - drv: prestera: add explicit padding to fix m68k build - drv: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge - drv: mvpp2: fix wrong SerDes reconfiguration order Misc & small latecomers: - ipvs: auto-load ipvs on genl access - mctp: sanity check the struct sockaddr_mctp padding fields - libfs: support RENAME_EXCHANGE in simple_rename() - avoid double accounting for pure zerocopy skbs" * tag 'net-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (123 commits) selftests/net: udpgso_bench_rx: fix port argument net: wwan: iosm: fix compilation warning cxgb4: fix eeprom len when diagnostics not implemented net: fix premature exit from NAPI state polling in napi_disable() net/smc: fix sk_refcnt underflow on linkdown and fallback net/mlx5: Lag, fix a potential Oops with mlx5_lag_create_definer() gve: fix unmatched u64_stats_update_end() net: ethernet: lantiq_etop: Fix compilation error selftests: forwarding: Fix packet matching in mirroring selftests vsock: prevent unnecessary refcnt inc for nonblocking connect net: marvell: mvpp2: Fix wrong SerDes reconfiguration order net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory net: stmmac: allow a tc-taprio base-time of zero selftests: net: test_vxlan_under_vrf: fix HV connectivity test net: hns3: allow configure ETS bandwidth of all TCs net: hns3: remove check VF uc mac exist when set by PF net: hns3: fix some mac statistics is always 0 in device version V2 net: hns3: fix kernel crash when unload VF while it is being reset net: hns3: sync rx ring head in echo common pull net: hns3: fix pfc packet number incorrect after querying pfc parameters ...
Showing the changes to kernel (2 of 134 files). Show all
Unified · Split
| @@ -390,6 +390,13 @@ static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, s32 end_old, · 389 unmodified lines | ||
| 390 | 390 | i = end_new; |
| 391 | 391 | insn = prog->insnsi + end_old; |
| 392 | 392 | } |
| 393 | + if (bpf_pseudo_func(insn)) { | |
| 394 | + ret = bpf_adj_delta_to_imm(insn, pos, end_old, | |
| 395 | + end_new, i, probe_pass); | |
| 396 | + if (ret) | |
| 397 | + return ret; | |
| 398 | + continue; | |
| 399 | + } | |
| 393 | 400 | code = insn->code; |
| 394 | 401 | if ((BPF_CLASS(code) != BPF_JMP && |
| 395 | 402 | BPF_CLASS(code) != BPF_JMP32) || |
| @@ -240,12 +240,6 @@ static bool bpf_pseudo_kfunc_call(const struct bpf_insn *insn) · 239 unmodified lines | ||
| 240 | 240 | insn->src_reg == BPF_PSEUDO_KFUNC_CALL; |
| 241 | 241 | } |
| 242 | 242 | |
| 243 | −static bool bpf_pseudo_func(const struct bpf_insn *insn) | |
| 244 | −{ | |
| 245 | − return insn->code == (BPF_LD | BPF_IMM | BPF_DW) && | |
| 246 | − insn->src_reg == BPF_PSEUDO_FUNC; | |
| 247 | −} | |
| 248 | − | |
| 249 | 243 | struct bpf_call_arg_meta { |
| 250 | 244 | struct bpf_map *map_ptr; |
| 251 | 245 | bool raw_mode; |
| @@ -1960,16 +1954,10 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env) · 1708 unmodified lines | ||
| 1960 | 1954 | return -EPERM; |
| 1961 | 1955 | } |
| 1962 | 1956 | |
| 1963 | − if (bpf_pseudo_func(insn)) { | |
| 1964 | − ret = add_subprog(env, i + insn->imm + 1); | |
| 1965 | − if (ret >= 0) | |
| 1966 | − /* remember subprog */ | |
| 1967 | − insn[1].imm = ret; | |
| 1968 | − } else if (bpf_pseudo_call(insn)) { | |
| 1957 | + if (bpf_pseudo_func(insn) || bpf_pseudo_call(insn)) | |
| 1969 | 1958 | ret = add_subprog(env, i + insn->imm + 1); |
| 1970 | − } else { | |
| 1959 | + else | |
| 1971 | 1960 | ret = add_kfunc_call(env, insn->imm, insn->off); |
| 1972 | − } | |
| 1973 | 1961 | |
| 1974 | 1962 | if (ret < 0) |
| 1975 | 1963 | return ret; |
| @@ -3088,9 +3076,12 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, · 1112 unmodified lines | ||
| 3088 | 3076 | reg = ®_state->stack[spi].spilled_ptr; |
| 3089 | 3077 | |
| 3090 | 3078 | if (is_spilled_reg(®_state->stack[spi])) { |
| 3091 | − if (size != BPF_REG_SIZE) { | |
| 3092 | − u8 scalar_size = 0; | |
| 3079 | + u8 spill_size = 1; | |
| 3080 | + | |
| 3081 | + for (i = BPF_REG_SIZE - 1; i > 0 && stype[i - 1] == STACK_SPILL; i--) | |
| 3082 | + spill_size++; | |
| 3093 | 3083 | |
| 3084 | + if (size != BPF_REG_SIZE || spill_size != BPF_REG_SIZE) { | |
| 3094 | 3085 | if (reg->type != SCALAR_VALUE) { |
| 3095 | 3086 | verbose_linfo(env, env->insn_idx, "; "); |
| 3096 | 3087 | verbose(env, "invalid size of register fill\n"); |
| @@ -3101,10 +3092,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, · 4 unmodified lines | ||
| 3101 | 3092 | if (dst_regno < 0) |
| 3102 | 3093 | return 0; |
| 3103 | 3094 | |
| 3104 | − for (i = BPF_REG_SIZE; i > 0 && stype[i - 1] == STACK_SPILL; i--) | |
| 3105 | − scalar_size++; | |
| 3106 | − | |
| 3107 | − if (!(off % BPF_REG_SIZE) && size == scalar_size) { | |
| 3095 | + if (!(off % BPF_REG_SIZE) && size == spill_size) { | |
| 3108 | 3096 | /* The earlier check_reg_arg() has decided the |
| 3109 | 3097 | * subreg_def for this insn. Save it first. |
| 3110 | 3098 | */ |
| @@ -3128,12 +3116,6 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, · 17 unmodified lines | ||
| 3128 | 3116 | state->regs[dst_regno].live |= REG_LIVE_WRITTEN; |
| 3129 | 3117 | return 0; |
| 3130 | 3118 | } |
| 3131 | − for (i = 1; i < BPF_REG_SIZE; i++) { | |
| 3132 | − if (stype[(slot - i) % BPF_REG_SIZE] != STACK_SPILL) { | |
| 3133 | − verbose(env, "corrupted spill memory\n"); | |
| 3134 | − return -EACCES; | |
| 3135 | − } | |
| 3136 | − } | |
| 3137 | 3119 | |
| 3138 | 3120 | if (dst_regno >= 0) { |
| 3139 | 3121 | /* restore register state from stack */ |
| @@ -9393,7 +9375,8 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn) · 6253 unmodified lines | ||
| 9393 | 9375 | |
| 9394 | 9376 | if (insn->src_reg == BPF_PSEUDO_FUNC) { |
| 9395 | 9377 | struct bpf_prog_aux *aux = env->prog->aux; |
| 9396 | − u32 subprogno = insn[1].imm; | |
| 9378 | + u32 subprogno = find_subprog(env, | |
| 9379 | + env->insn_idx + insn->imm + 1); | |
| 9397 | 9380 | |
| 9398 | 9381 | if (!aux->func_info) { |
| 9399 | 9382 | verbose(env, "missing btf func_info\n"); |
| @@ -12563,14 +12546,9 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 3163 unmodified lines | ||
| 12563 | 12546 | return 0; |
| 12564 | 12547 | |
| 12565 | 12548 | for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) { |
| 12566 | − if (bpf_pseudo_func(insn)) { | |
| 12567 | − env->insn_aux_data[i].call_imm = insn->imm; | |
| 12568 | − /* subprog is encoded in insn[1].imm */ | |
| 12549 | + if (!bpf_pseudo_func(insn) && !bpf_pseudo_call(insn)) | |
| 12569 | 12550 | continue; |
| 12570 | − } | |
| 12571 | 12551 | |
| 12572 | − if (!bpf_pseudo_call(insn)) | |
| 12573 | − continue; | |
| 12574 | 12552 | /* Upon error here we cannot fall back to interpreter but |
| 12575 | 12553 | * need a hard reject of the program. Thus -EFAULT is |
| 12576 | 12554 | * propagated in any case. |
| @@ -12591,6 +12569,12 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 14 unmodified lines | ||
| 12591 | 12569 | env->insn_aux_data[i].call_imm = insn->imm; |
| 12592 | 12570 | /* point imm to __bpf_call_base+1 from JITs point of view */ |
| 12593 | 12571 | insn->imm = 1; |
| 12572 | + if (bpf_pseudo_func(insn)) | |
| 12573 | + /* jit (e.g. x86_64) may emit fewer instructions | |
| 12574 | + * if it learns a u32 imm is the same as a u64 imm. | |
| 12575 | + * Force a non zero here. | |
| 12576 | + */ | |
| 12577 | + insn[1].imm = 1; | |
| 12594 | 12578 | } |
| 12595 | 12579 | |
| 12596 | 12580 | err = bpf_prog_alloc_jited_linfo(prog); |
| @@ -12675,7 +12659,7 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 78 unmodified lines | ||
| 12675 | 12659 | insn = func[i]->insnsi; |
| 12676 | 12660 | for (j = 0; j < func[i]->len; j++, insn++) { |
| 12677 | 12661 | if (bpf_pseudo_func(insn)) { |
| 12678 | − subprog = insn[1].imm; | |
| 12662 | + subprog = insn->off; | |
| 12679 | 12663 | insn[0].imm = (u32)(long)func[subprog]->bpf_func; |
| 12680 | 12664 | insn[1].imm = ((u64)(long)func[subprog]->bpf_func) >> 32; |
| 12681 | 12665 | continue; |
| @@ -12726,7 +12710,8 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 44 unmodified lines | ||
| 12726 | 12710 | for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) { |
| 12727 | 12711 | if (bpf_pseudo_func(insn)) { |
| 12728 | 12712 | insn[0].imm = env->insn_aux_data[i].call_imm; |
| 12729 | − insn[1].imm = find_subprog(env, i + insn[0].imm + 1); | |
| 12713 | + insn[1].imm = insn->off; | |
| 12714 | + insn->off = 0; | |
| 12730 | 12715 | continue; |
| 12731 | 12716 | } |
| 12732 | 12717 | if (!bpf_pseudo_call(insn)) |