Commit fceb0795 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 

Alexei Starovoitov says:

====================
pull-request: bpf 2021-11-09

We've added 7 non-merge commits during the last 3 day(s) which contain
a total of 10 files changed, 174 insertions(+), 48 deletions(-).

The main changes are:

1) Various sockmap fixes, from John and Jussi.

2) Fix out-of-bound issue with bpf_pseudo_func, from Martin.

* https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
  bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
  bpf, sockmap: Fix race in ingress receive verdict with redirect to self
  bpf, sockmap: Remove unhash handler for BPF sockmap usage
  bpf, sockmap: Use stricter sk state checks in sk_lookup_assign
  bpf: selftest: Trigger a DCE on the whole subprog
  bpf: Stop caching subprog index in the bpf_pseudo_func insn
====================

Link: https://lore.kernel.org/r/20211109215702.38350-1-alexei.starovoitov@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 9758aba8 b2c46181

include/linux/bpf.h

+6 −0
Original line number Diff line number Diff line
@@ -484,6 +484,12 @@ bpf_ctx_record_field_size(struct bpf_insn_access_aux *aux, u32 size) 
	aux->ctx_field_size = size;

}



static inline bool bpf_pseudo_func(const struct bpf_insn *insn)

{

	return insn->code == (BPF_LD | BPF_IMM | BPF_DW) &&

	       insn->src_reg == BPF_PSEUDO_FUNC;

}



struct bpf_prog_ops {

	int (*test_run)(struct bpf_prog *prog, const union bpf_attr *kattr,

			union bpf_attr __user *uattr);

include/linux/skmsg.h

+12 −0
Original line number Diff line number Diff line
@@ -507,6 +507,18 @@ static inline bool sk_psock_strp_enabled(struct sk_psock *psock) 
	return !!psock->saved_data_ready;

}



static inline bool sk_is_tcp(const struct sock *sk)

{

	return sk->sk_type == SOCK_STREAM &&

	       sk->sk_protocol == IPPROTO_TCP;

}



static inline bool sk_is_udp(const struct sock *sk)

{

	return sk->sk_type == SOCK_DGRAM &&

	       sk->sk_protocol == IPPROTO_UDP;

}



#if IS_ENABLED(CONFIG_NET_SOCK_MSG)



#define BPF_F_STRPARSER	(1UL << 1)

include/net/strparser.h

+19 −1
Original line number Diff line number Diff line
@@ -54,10 +54,28 @@ struct strp_msg { 
	int offset;

};



struct _strp_msg {

	/* Internal cb structure. struct strp_msg must be first for passing

	 * to upper layer.

	 */

	struct strp_msg strp;

	int accum_len;

};



struct sk_skb_cb {

#define SK_SKB_CB_PRIV_LEN 20

	unsigned char data[SK_SKB_CB_PRIV_LEN];

	struct _strp_msg strp;

	/* temp_reg is a temporary register used for bpf_convert_data_end_access

	 * when dst_reg == src_reg.

	 */

	u64 temp_reg;

};



static inline struct strp_msg *strp_msg(struct sk_buff *skb)

{

	return (struct strp_msg *)((void *)skb->cb +

		offsetof(struct qdisc_skb_cb, data));

		offsetof(struct sk_skb_cb, strp));

}



/* Structure for an attached lower socket */

kernel/bpf/core.c

+7 −0
Original line number Diff line number Diff line
@@ -390,6 +390,13 @@ static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, s32 end_old, 
			i = end_new;

			insn = prog->insnsi + end_old;

		}

		if (bpf_pseudo_func(insn)) {

			ret = bpf_adj_delta_to_imm(insn, pos, end_old,

						   end_new, i, probe_pass);

			if (ret)

				return ret;

			continue;

		}

		code = insn->code;

		if ((BPF_CLASS(code) != BPF_JMP &&

		     BPF_CLASS(code) != BPF_JMP32) ||

kernel/bpf/verifier.c

+14 −23
Original line number Diff line number Diff line
@@ -240,12 +240,6 @@ static bool bpf_pseudo_kfunc_call(const struct bpf_insn *insn) 
	       insn->src_reg == BPF_PSEUDO_KFUNC_CALL;

}



static bool bpf_pseudo_func(const struct bpf_insn *insn)

{

	return insn->code == (BPF_LD | BPF_IMM | BPF_DW) &&

	       insn->src_reg == BPF_PSEUDO_FUNC;

}



struct bpf_call_arg_meta {

	struct bpf_map *map_ptr;

	bool raw_mode;
@@ -1960,16 +1954,10 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env) 
			return -EPERM;

		}



		if (bpf_pseudo_func(insn)) {

		if (bpf_pseudo_func(insn) || bpf_pseudo_call(insn))

			ret = add_subprog(env, i + insn->imm + 1);

			if (ret >= 0)

				/* remember subprog */

				insn[1].imm = ret;

		} else if (bpf_pseudo_call(insn)) {

			ret = add_subprog(env, i + insn->imm + 1);

		} else {

		else

			ret = add_kfunc_call(env, insn->imm, insn->off);

		}



		if (ret < 0)

			return ret;
@@ -9387,7 +9375,8 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn) 


	if (insn->src_reg == BPF_PSEUDO_FUNC) {

		struct bpf_prog_aux *aux = env->prog->aux;

		u32 subprogno = insn[1].imm;

		u32 subprogno = find_subprog(env,

					     env->insn_idx + insn->imm + 1);



		if (!aux->func_info) {

			verbose(env, "missing btf func_info\n");
@@ -12557,14 +12546,9 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
		return 0;



	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {

		if (bpf_pseudo_func(insn)) {

			env->insn_aux_data[i].call_imm = insn->imm;

			/* subprog is encoded in insn[1].imm */

		if (!bpf_pseudo_func(insn) && !bpf_pseudo_call(insn))

			continue;

		}



		if (!bpf_pseudo_call(insn))

			continue;

		/* Upon error here we cannot fall back to interpreter but

		 * need a hard reject of the program. Thus -EFAULT is

		 * propagated in any case.
@@ -12585,6 +12569,12 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
		env->insn_aux_data[i].call_imm = insn->imm;

		/* point imm to __bpf_call_base+1 from JITs point of view */

		insn->imm = 1;

		if (bpf_pseudo_func(insn))

			/* jit (e.g. x86_64) may emit fewer instructions

			 * if it learns a u32 imm is the same as a u64 imm.

			 * Force a non zero here.

			 */

			insn[1].imm = 1;

	}



	err = bpf_prog_alloc_jited_linfo(prog);
@@ -12669,7 +12659,7 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
		insn = func[i]->insnsi;

		for (j = 0; j < func[i]->len; j++, insn++) {

			if (bpf_pseudo_func(insn)) {

				subprog = insn[1].imm;

				subprog = insn->off;

				insn[0].imm = (u32)(long)func[subprog]->bpf_func;

				insn[1].imm = ((u64)(long)func[subprog]->bpf_func) >> 32;

				continue;
@@ -12720,7 +12710,8 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {

		if (bpf_pseudo_func(insn)) {

			insn[0].imm = env->insn_aux_data[i].call_imm;

			insn[1].imm = find_subprog(env, i + insn[0].imm + 1);

			insn[1].imm = insn->off;

			insn->off = 0;

			continue;

		}

		if (!bpf_pseudo_call(insn))