Commit 7a2fb912 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 

Alexei Starovoitov says:

====================
pull-request: bpf 2022-02-17

We've added 8 non-merge commits during the last 7 day(s) which contain
a total of 8 files changed, 119 insertions(+), 15 deletions(-).

The main changes are:

1) Add schedule points in map batch ops, from Eric.

2) Fix bpf_msg_push_data with len 0, from Felix.

3) Fix crash due to incorrect copy_map_value, from Kumar.

4) Fix crash due to out of bounds access into reg2btf_ids, from Kumar.

5) Fix a bpf_timer initialization issue with clang, from Yonghong.

* https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf: Add schedule points in batch ops
  bpf: Fix crash due to out of bounds access into reg2btf_ids.
  selftests: bpf: Check bpf_msg_push_data return value
  bpf: Fix a bpf_timer initialization issue
  bpf: Emit bpf_timer in vmlinux BTF
  selftests/bpf: Add test for bpf_timer overwriting crash
  bpf: Fix crash due to incorrect copy_map_value
  bpf: Do not try bpf_msg_push_data with len 0
====================

Link: https://lore.kernel.org/r/20220217190000.37925-1-alexei.starovoitov@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 8b97cae3 75134f16

include/linux/bpf.h

+4 −5
Original line number Diff line number Diff line
@@ -209,11 +209,9 @@ static inline bool map_value_has_timer(const struct bpf_map *map) 
static inline void check_and_init_map_value(struct bpf_map *map, void *dst)

{

	if (unlikely(map_value_has_spin_lock(map)))

		*(struct bpf_spin_lock *)(dst + map->spin_lock_off) =

			(struct bpf_spin_lock){};

		memset(dst + map->spin_lock_off, 0, sizeof(struct bpf_spin_lock));

	if (unlikely(map_value_has_timer(map)))

		*(struct bpf_timer *)(dst + map->timer_off) =

			(struct bpf_timer){};

		memset(dst + map->timer_off, 0, sizeof(struct bpf_timer));

}



/* copy everything but bpf_spin_lock and bpf_timer. There could be one of each. */
@@ -224,7 +222,8 @@ static inline void copy_map_value(struct bpf_map *map, void *dst, void *src) 
	if (unlikely(map_value_has_spin_lock(map))) {

		s_off = map->spin_lock_off;

		s_sz = sizeof(struct bpf_spin_lock);

	} else if (unlikely(map_value_has_timer(map))) {

	}

	if (unlikely(map_value_has_timer(map))) {

		t_off = map->timer_off;

		t_sz = sizeof(struct bpf_timer);

	}

kernel/bpf/btf.c

+3 −2
Original line number Diff line number Diff line
@@ -5688,7 +5688,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, 
			}

			if (check_ptr_off_reg(env, reg, regno))

				return -EINVAL;

		} else if (is_kfunc && (reg->type == PTR_TO_BTF_ID || reg2btf_ids[reg->type])) {

		} else if (is_kfunc && (reg->type == PTR_TO_BTF_ID ||

			   (reg2btf_ids[base_type(reg->type)] && !type_flag(reg->type)))) {

			const struct btf_type *reg_ref_t;

			const struct btf *reg_btf;

			const char *reg_ref_tname;
@@ -5706,7 +5707,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, 
				reg_ref_id = reg->btf_id;

			} else {

				reg_btf = btf_vmlinux;

				reg_ref_id = *reg2btf_ids[reg->type];

				reg_ref_id = *reg2btf_ids[base_type(reg->type)];

			}



			reg_ref_t = btf_type_skip_modifiers(reg_btf, reg_ref_id,

kernel/bpf/helpers.c

+2 −0
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com

 */

#include <linux/bpf.h>

#include <linux/btf.h>

#include <linux/bpf-cgroup.h>

#include <linux/rcupdate.h>

#include <linux/random.h>
@@ -1075,6 +1076,7 @@ static enum hrtimer_restart bpf_timer_cb(struct hrtimer *hrtimer) 
	void *key;

	u32 idx;



	BTF_TYPE_EMIT(struct bpf_timer);

	callback_fn = rcu_dereference_check(t->callback_fn, rcu_read_lock_bh_held());

	if (!callback_fn)

		goto out;

kernel/bpf/syscall.c

+3 −0
Original line number Diff line number Diff line
@@ -1355,6 +1355,7 @@ int generic_map_delete_batch(struct bpf_map *map, 
		maybe_wait_bpf_programs(map);

		if (err)

			break;

		cond_resched();

	}

	if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))

		err = -EFAULT;
@@ -1412,6 +1413,7 @@ int generic_map_update_batch(struct bpf_map *map, 


		if (err)

			break;

		cond_resched();

	}



	if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))
@@ -1509,6 +1511,7 @@ int generic_map_lookup_batch(struct bpf_map *map, 
		swap(prev_key, key);

		retry = MAP_LOOKUP_RETRIES;

		cp++;

		cond_resched();

	}



	if (err == -EFAULT)

net/core/filter.c

+3 −0
Original line number Diff line number Diff line
@@ -2710,6 +2710,9 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, 
	if (unlikely(flags))

		return -EINVAL;



	if (unlikely(len == 0))

		return 0;



	/* First find the starting scatterlist element */

	i = msg->sg.start;

	do {