Commit f5d28712 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 



Daniel Borkmann says:

====================
pull-request: bpf 2021-05-26

The following pull-request contains BPF updates for your *net* tree.

We've added 14 non-merge commits during the last 14 day(s) which contain
a total of 17 files changed, 513 insertions(+), 231 deletions(-).

The main changes are:

1) Fix bpf_skb_change_head() helper to reset mac_len, from Jussi Maki.

2) Fix masking direction swap upon off-reg sign change, from Daniel Borkmann.

3) Fix BPF offloads in verifier by reordering driver callback, from Yinjun Zhang.

4) BPF selftest for ringbuf mmap ro/rw restrictions, from Andrii Nakryiko.

5) Follow-up fixes to nested bprintf per-cpu buffers, from Florent Revest.

6) Fix bpftool sock_release attach point help info, from Liu Jian.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 6dfa87b4 1bad6fd5

arch/arm64/Kbuild

+1 −2
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0-only

obj-y			+= kernel/ mm/

obj-$(CONFIG_NET)	+= net/

obj-y			+= kernel/ mm/ net/

obj-$(CONFIG_KVM)	+= kvm/

obj-$(CONFIG_XEN)	+= xen/

obj-$(CONFIG_CRYPTO)	+= crypto/

kernel/bpf/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ config BPF_SYSCALL 


config BPF_JIT

	bool "Enable BPF Just In Time compiler"

	depends on BPF

	depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT

	depends on MODULES

	help

kernel/bpf/bpf_lsm.c

+2 −0
Original line number Diff line number Diff line
@@ -107,10 +107,12 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
		return &bpf_inode_storage_get_proto;

	case BPF_FUNC_inode_storage_delete:

		return &bpf_inode_storage_delete_proto;

#ifdef CONFIG_NET

	case BPF_FUNC_sk_storage_get:

		return &bpf_sk_storage_get_proto;

	case BPF_FUNC_sk_storage_delete:

		return &bpf_sk_storage_delete_proto;

#endif /* CONFIG_NET */

	case BPF_FUNC_spin_lock:

		return &bpf_spin_lock_proto;

	case BPF_FUNC_spin_unlock:

kernel/bpf/helpers.c

+7 −5
Original line number Diff line number Diff line
@@ -692,13 +692,15 @@ static int bpf_trace_copy_string(char *buf, void *unsafe_ptr, char fmt_ptype, 
	return -EINVAL;

}



/* Per-cpu temp buffers which can be used by printf-like helpers for %s or %p

/* Per-cpu temp buffers used by printf-like helpers to store the bprintf binary

 * arguments representation.

 */

#define MAX_PRINTF_BUF_LEN	512

#define MAX_BPRINTF_BUF_LEN	512



/* Support executing three nested bprintf helper calls on a given CPU */

#define MAX_BPRINTF_NEST_LEVEL	3

struct bpf_bprintf_buffers {

	char tmp_bufs[3][MAX_PRINTF_BUF_LEN];

	char tmp_bufs[MAX_BPRINTF_NEST_LEVEL][MAX_BPRINTF_BUF_LEN];

};

static DEFINE_PER_CPU(struct bpf_bprintf_buffers, bpf_bprintf_bufs);

static DEFINE_PER_CPU(int, bpf_bprintf_nest_level);
@@ -710,7 +712,7 @@ static int try_get_fmt_tmp_buf(char **tmp_buf) 


	preempt_disable();

	nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);

	if (WARN_ON_ONCE(nest_level > ARRAY_SIZE(bufs->tmp_bufs))) {

	if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {

		this_cpu_dec(bpf_bprintf_nest_level);

		preempt_enable();

		return -EBUSY;
@@ -761,7 +763,7 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, 
		if (num_args && try_get_fmt_tmp_buf(&tmp_buf))

			return -EBUSY;



		tmp_buf_end = tmp_buf + MAX_PRINTF_BUF_LEN;

		tmp_buf_end = tmp_buf + MAX_BPRINTF_BUF_LEN;

		*bin_args = (u32 *)tmp_buf;

	}

kernel/bpf/verifier.c

+34 −24
Original line number Diff line number Diff line
@@ -6409,18 +6409,10 @@ enum { 
};



static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,

			      const struct bpf_reg_state *off_reg,

			      u32 *alu_limit, u8 opcode)

			      u32 *alu_limit, bool mask_to_left)

{

	bool off_is_neg = off_reg->smin_value < 0;

	bool mask_to_left = (opcode == BPF_ADD &&  off_is_neg) ||

			    (opcode == BPF_SUB && !off_is_neg);

	u32 max = 0, ptr_limit = 0;



	if (!tnum_is_const(off_reg->var_off) &&

	    (off_reg->smin_value < 0) != (off_reg->smax_value < 0))

		return REASON_BOUNDS;



	switch (ptr_reg->type) {

	case PTR_TO_STACK:

		/* Offset 0 is out-of-bounds, but acceptable start for the
@@ -6486,15 +6478,20 @@ static bool sanitize_needed(u8 opcode) 
	return opcode == BPF_ADD || opcode == BPF_SUB;

}



struct bpf_sanitize_info {

	struct bpf_insn_aux_data aux;

	bool mask_to_left;

};



static int sanitize_ptr_alu(struct bpf_verifier_env *env,

			    struct bpf_insn *insn,

			    const struct bpf_reg_state *ptr_reg,

			    const struct bpf_reg_state *off_reg,

			    struct bpf_reg_state *dst_reg,

			    struct bpf_insn_aux_data *tmp_aux,

			    struct bpf_sanitize_info *info,

			    const bool commit_window)

{

	struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : tmp_aux;

	struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : &info->aux;

	struct bpf_verifier_state *vstate = env->cur_state;

	bool off_is_imm = tnum_is_const(off_reg->var_off);

	bool off_is_neg = off_reg->smin_value < 0;
@@ -6515,7 +6512,16 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
	if (vstate->speculative)

		goto do_sim;



	err = retrieve_ptr_limit(ptr_reg, off_reg, &alu_limit, opcode);

	if (!commit_window) {

		if (!tnum_is_const(off_reg->var_off) &&

		    (off_reg->smin_value < 0) != (off_reg->smax_value < 0))

			return REASON_BOUNDS;



		info->mask_to_left = (opcode == BPF_ADD &&  off_is_neg) ||

				     (opcode == BPF_SUB && !off_is_neg);

	}



	err = retrieve_ptr_limit(ptr_reg, &alu_limit, info->mask_to_left);

	if (err < 0)

		return err;
@@ -6523,8 +6529,8 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
		/* In commit phase we narrow the masking window based on

		 * the observed pointer move after the simulated operation.

		 */

		alu_state = tmp_aux->alu_state;

		alu_limit = abs(tmp_aux->alu_limit - alu_limit);

		alu_state = info->aux.alu_state;

		alu_limit = abs(info->aux.alu_limit - alu_limit);

	} else {

		alu_state  = off_is_neg ? BPF_ALU_NEG_VALUE : 0;

		alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0;
@@ -6539,8 +6545,12 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
	/* If we're in commit phase, we're done here given we already

	 * pushed the truncated dst_reg into the speculative verification

	 * stack.

	 *

	 * Also, when register is a known constant, we rewrite register-based

	 * operation to immediate-based, and thus do not need masking (and as

	 * a consequence, do not need to simulate the zero-truncation either).

	 */

	if (commit_window)

	if (commit_window || off_is_imm)

		return 0;



	/* Simulate and find potential out-of-bounds access under
@@ -6685,7 +6695,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
	    smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;

	u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,

	    umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;

	struct bpf_insn_aux_data tmp_aux = {};

	struct bpf_sanitize_info info = {};

	u8 opcode = BPF_OP(insn->code);

	u32 dst = insn->dst_reg;

	int ret;
@@ -6754,7 +6764,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 


	if (sanitize_needed(opcode)) {

		ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,

				       &tmp_aux, false);

				       &info, false);

		if (ret < 0)

			return sanitize_err(env, insn, ret, off_reg, dst_reg);

	}
@@ -6895,7 +6905,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
		return -EACCES;

	if (sanitize_needed(opcode)) {

		ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,

				       &tmp_aux, true);

				       &info, true);

		if (ret < 0)

			return sanitize_err(env, insn, ret, off_reg, dst_reg);

	}
@@ -13368,12 +13378,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, 
	if (is_priv)

		env->test_state_freq = attr->prog_flags & BPF_F_TEST_STATE_FREQ;



	if (bpf_prog_is_dev_bound(env->prog->aux)) {

		ret = bpf_prog_offload_verifier_prep(env->prog);

		if (ret)

			goto skip_full_check;

	}



	env->explored_states = kvcalloc(state_htab_size(env),

				       sizeof(struct bpf_verifier_state_list *),

				       GFP_USER);
@@ -13401,6 +13405,12 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, 
	if (ret < 0)

		goto skip_full_check;



	if (bpf_prog_is_dev_bound(env->prog->aux)) {

		ret = bpf_prog_offload_verifier_prep(env->prog);

		if (ret)

			goto skip_full_check;

	}



	ret = check_cfg(env);

	if (ret < 0)

		goto skip_full_check;