Commit 0548c5f2 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 

Daniel Borkmann says:

====================
bpf 2023-01-27

We've added 10 non-merge commits during the last 9 day(s) which contain
a total of 10 files changed, 170 insertions(+), 59 deletions(-).

The main changes are:

1) Fix preservation of register's parent/live fields when copying
   range-info, from Eduard Zingerman.

2) Fix an off-by-one bug in bpf_mem_cache_idx() to select the right
   cache, from Hou Tao.

3) Fix stack overflow from infinite recursion in sock_map_close(),
   from Jakub Sitnicki.

4) Fix missing btf_put() in register_btf_id_dtor_kfuncs()'s error path,
   from Jiri Olsa.

5) Fix a splat from bpf_setsockopt() via lsm_cgroup/socket_sock_rcv_skb,
   from Kui-Feng Lee.

6) Fix bpf_send_signal[_thread]() helpers to hold a reference on the task,
   from Yonghong Song.

* tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf: Fix the kernel crash caused by bpf_setsockopt().
  selftests/bpf: Cover listener cloning with progs attached to sockmap
  selftests/bpf: Pass BPF skeleton to sockmap_listen ops tests
  bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
  bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
  bpf: Add missing btf_put to register_btf_id_dtor_kfuncs
  selftests/bpf: Verify copy_register_state() preserves parent/live fields
  bpf: Fix to preserve reg parent/live fields when copying range info
  bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers
  bpf: Fix off-by-one error in bpf_mem_cache_idx()
====================

Link: https://lore.kernel.org/r/20230127215820.4993-1-daniel@iogearbox.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 7d2c89b3 5416c9ae

include/linux/util_macros.h

+12 −0
Original line number Diff line number Diff line
@@ -38,4 +38,16 @@ 
 */

#define find_closest_descending(x, a, as) __find_closest(x, a, as, >=)



/**

 * is_insidevar - check if the @ptr points inside the @var memory range.

 * @ptr:	the pointer to a memory address.

 * @var:	the variable which address and size identify the memory range.

 *

 * Evaluates to true if the address in @ptr lies within the memory

 * range allocated to @var.

 */

#define is_insidevar(ptr, var)						\

	((uintptr_t)(ptr) >= (uintptr_t)(var) &&			\

	 (uintptr_t)(ptr) <  (uintptr_t)(var) + sizeof(var))



#endif

kernel/bpf/bpf_lsm.c

+0 −1
Original line number Diff line number Diff line
@@ -51,7 +51,6 @@ BTF_SET_END(bpf_lsm_current_hooks) 
 */

BTF_SET_START(bpf_lsm_locked_sockopt_hooks)

#ifdef CONFIG_SECURITY_NETWORK

BTF_ID(func, bpf_lsm_socket_sock_rcv_skb)

BTF_ID(func, bpf_lsm_sock_graft)

BTF_ID(func, bpf_lsm_inet_csk_clone)

BTF_ID(func, bpf_lsm_inet_conn_established)

kernel/bpf/btf.c

+2 −2
Original line number Diff line number Diff line
@@ -7782,8 +7782,8 @@ int register_btf_id_dtor_kfuncs(const struct btf_id_dtor_kfunc *dtors, u32 add_c 


	sort(tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func, NULL);



	return 0;

end:

	if (ret)

		btf_free_dtor_kfunc_tab(btf);

	btf_put(btf);

	return ret;

kernel/bpf/memalloc.c

+1 −1
Original line number Diff line number Diff line
@@ -71,7 +71,7 @@ static int bpf_mem_cache_idx(size_t size) 
	if (size <= 192)

		return size_index[(size - 1) / 8] - 1;



	return fls(size - 1) - 1;

	return fls(size - 1) - 2;

}



#define NUM_CACHES 11

kernel/bpf/verifier.c

+18 −7
Original line number Diff line number Diff line
@@ -3243,13 +3243,24 @@ static bool __is_pointer_value(bool allow_ptr_leaks, 
	return reg->type != SCALAR_VALUE;

}



/* Copy src state preserving dst->parent and dst->live fields */

static void copy_register_state(struct bpf_reg_state *dst, const struct bpf_reg_state *src)

{

	struct bpf_reg_state *parent = dst->parent;

	enum bpf_reg_liveness live = dst->live;



	*dst = *src;

	dst->parent = parent;

	dst->live = live;

}



static void save_register_state(struct bpf_func_state *state,

				int spi, struct bpf_reg_state *reg,

				int size)

{

	int i;



	state->stack[spi].spilled_ptr = *reg;

	copy_register_state(&state->stack[spi].spilled_ptr, reg);

	if (size == BPF_REG_SIZE)

		state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
@@ -3577,7 +3588,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, 
				 */

				s32 subreg_def = state->regs[dst_regno].subreg_def;



				state->regs[dst_regno] = *reg;

				copy_register_state(&state->regs[dst_regno], reg);

				state->regs[dst_regno].subreg_def = subreg_def;

			} else {

				for (i = 0; i < size; i++) {
@@ -3598,7 +3609,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, 


		if (dst_regno >= 0) {

			/* restore register state from stack */

			state->regs[dst_regno] = *reg;

			copy_register_state(&state->regs[dst_regno], reg);

			/* mark reg as written since spilled pointer state likely

			 * has its liveness marks cleared by is_state_visited()

			 * which resets stack/reg liveness for state transitions
@@ -9592,7 +9603,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
	 */

	if (!ptr_is_dst_reg) {

		tmp = *dst_reg;

		*dst_reg = *ptr_reg;

		copy_register_state(dst_reg, ptr_reg);

	}

	ret = sanitize_speculative_path(env, NULL, env->insn_idx + 1,

					env->insn_idx);
@@ -10845,7 +10856,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) 
					 * to propagate min/max range.

					 */

					src_reg->id = ++env->id_gen;

				*dst_reg = *src_reg;

				copy_register_state(dst_reg, src_reg);

				dst_reg->live |= REG_LIVE_WRITTEN;

				dst_reg->subreg_def = DEF_NOT_SUBREG;

			} else {
@@ -10856,7 +10867,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) 
						insn->src_reg);

					return -EACCES;

				} else if (src_reg->type == SCALAR_VALUE) {

					*dst_reg = *src_reg;

					copy_register_state(dst_reg, src_reg);

					/* Make sure ID is cleared otherwise

					 * dst_reg min/max could be incorrectly

					 * propagated into src_reg by find_equal_scalars()
@@ -11655,7 +11666,7 @@ static void find_equal_scalars(struct bpf_verifier_state *vstate, 


	bpf_for_each_reg_in_vstate(vstate, state, reg, ({

		if (reg->type == SCALAR_VALUE && reg->id == known_reg->id)

			*reg = *known_reg;

			copy_register_state(reg, known_reg);

	}));

}